Archive
18 November 2022
Vulnerabilities first published on this day (UTC), newest first.
105 results · Feed
-
High 7.5
WordPress Welcart eCommerce plugin <= 2.7.7 - Unauth. Directory Traversal vulnerability
Unauth. Directory Traversal vulnerability in Welcart eCommerce plugin <= 2.7.7 on WordPress.
-
Medium 4.3
WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability
Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with subscriber or higher user roles to change the status of the translation jobs.
-
Medium 4.9
IBM OpenBMC denial of service
IBM OpenBMC OP910 and OP940 could allow a privileged user to cause a denial of service by uploading or deleting too many CA certificates in a short period of time. IBM X-Force ID: 2226337.
-
Low 3.5
In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address
-
Medium 6.5
Unauthorized modification in Karmasis Informatics Infraskope SIEM+
Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to damage the page where the agents are listed.
-
High 8.2
Unauthorized modification in Karmasis Informatics Infraskope SIEM+
Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to obtain critical information.
-
Medium 4.4
NVIDIA CUDA Toolkit SDK contains a stack-based buffer overflow vulnerability in cuobjdump, where an unprivileged remote…
-
High 8.8
Carel Boss Mini 1.5.0 has Improper Access Control.
-
Medium 6.5
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a local user w…
-
High 7.4
When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional head…
-
High 7.5
Free5gc vulnerable to uncontrolled resource consumption
In Free5gc v3.0.5, the AMF breaks due to malformed NAS messages.
-
High 7.8
NVIDIA GPU Display Driver for Linux contains a vulnerability in an optional D-Bus configuration file, where a local use…
-
High 7.8
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where a local u…
-
High 7.8
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where a local user w…
-
High 7.1
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer, where any local user can cause…
-
High 7.8
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where a local u…
-
Medium 6.1
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for Dxgk…
-
High 7.3
InstallBuilder Qt installers built with versions previous to 22.10 try to load DLLs from the installer binary parent di…
-
High 7.1
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for Dxgk…
-
Medium 5.5
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a local user with basic ca…
-
High 7.8
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for Dxgk…
-
Medium 5.5
In drachtio-server 0.8.18, /var/log/drachtio has mode 0777 and drachtio.log has mode 0666.
-
Critical 9.8
In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user…
-
Critical 9.8
drachtio-server 0.8.18 has a request-handler.cpp event_cb use-after-free for any request.
-
Medium 5.3
An information-disclosure vulnerability exists on select NXP devices when configured in Serial Download Protocol (SDP) …
-
High 7.5
An issue was discovered in MaraDNS Deadwood through 3.5.0021 that allows variant V1 of unintended domain name resolutio…
-
Medium 6.5
In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLR…
-
High 7.2
Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/mechanics/view_mechanic.php?id=.
-
High 7.2
Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=delete_service.
-
High 7.2
Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/services/manage_service.php?id=.
-
High 7.2
Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/mechanics/manage_mechanic.php?id=.
-
Critical 9.8
D-Link DIR3060 DIR3060A1_FW111B04.bin is vulnerable to Buffer Overflow.
-
High 7.2
Automotive Shop Management System v1.0 is vulnerable to SQL via /asms/classes/Master.php?f=delete_mechanic.
-
High 7.2
Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/?page=transactions/manage_transac…
-
Medium 4.8
Unckecked rank size in `tf.image.generate_bounding_box_proposals` in Tensorflow
TensorFlow is an open source platform for machine learning. When running on GPU, `tf.image.generate_bounding_box_proposals` receives a `scores` input that must be of rank 4 but is not checked. We have patched the issue in GitHub commit cf35502463a88ca7185a99d…
-
Medium 4.8
`tf.raw_ops.Mfcc` crashes in Tensorflow
TensorFlow is an open source platform for machine learning. If `ThreadUnsafeUnigramCandidateSampler` is given input `filterbank_channel_count` greater than the allowed max size, TensorFlow will crash. We have patched the issue in GitHub commit 39ec7eaf1428e90…
-
Medium 4.8
`MirrorPadGrad` heap out of bounds read in Tensorflow
TensorFlow is an open source platform for machine learning. If `MirrorPadGrad` is given outsize input `paddings`, TensorFlow will give a heap OOB error. We have patched the issue in GitHub commit 717ca98d8c3bba348ff62281fdf38dcb5ea1ec92. The fix will be inclu…
-
Medium 4.8
`CHECK` fail via inputs in `PyFunc` in Tensorflow
TensorFlow is an open source platform for machine learning. An input `token` that is not a UTF-8 bytestring will trigger a `CHECK` fail in `tf.raw_ops.PyFunc`. We have patched the issue in GitHub commit 9f03a9d3bafe902c1e6beb105b2f24172f238645. The fix will b…
-
Medium 6.8
Out of bounds segmentation fault due to unequal op inputs in Tensorflow
TensorFlow is an open source platform for machine learning. When ops that have specified input sizes receive a differing number of inputs, the executor will crash. We have patched the issue in GitHub commit f5381e0e10b5a61344109c1b7c174c68110f7629. The fix wi…
-
Medium 4.8
Overflow in `tf.keras.losses.poisson` in Tensorflow
TensorFlow is an open source platform for machine learning. `tf.keras.losses.poisson` receives a `y_pred` and `y_true` that are passed through `functor::mul` in `BinaryOp`. If the resulting dimensions overflow an `int32`, TensorFlow will crash due to a size m…