Archive
7 December 2022
Vulnerabilities first published on this day (UTC), newest first.
31 results · Clear filters · Feed
-
High 7.7
Aswjsflt.dll in Avast Antivirus windows caused a crash of the Mozilla Firefox browser due to heap corruption
The aswjsflt.dll library from Avast Antivirus windows contained a potentially exploitable heap corruption vulnerability that could enable an attacker to bypass the sandbox of the application it was loaded into, if applicable. This issue was fixed in version 1…
-
High 7.8
GE CIMPLICITY Out-of-bounds Write
GE CIMPICITY versions 2022 and prior is vulnerable to an out-of-bounds write, which could allow an attacker to execute arbitrary code.
-
High 7.8
GE CIMPLICITY Access of Uninitialized Pointer
GE CIMPICITY versions 2022 and prior is vulnerable when data from a faulting address controls code flow starting at gmmiObj!CGmmiRootOptionTable, which could allow an attacker to execute arbitrary code.
-
High 7.8
GE CIMPLICITY Access of Uninitialized Pointer
GE CIMPICITY versions 2022 and prior is vulnerable when data from a faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, which could allow an attacker to execute arbitrary code.
-
High 7.8
GE CIMPLICITY Heap-based Buffer Overflow
GE CIMPICITY versions 2022 and prior is vulnerable to a heap-based buffer overflow, which could allow an attacker to execute arbitrary code.
-
High 7.8
GE CIMPLICITY Untrusted Pointer Dereference
GE CIMPICITY versions 2022 and prior is vulnerable when data from faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, which could allow an attacker to execute arbitrary code.
-
High 7.5
libp2p denial of service vulnerability from lack of resource management
js-libp2p is the official javascript Implementation of libp2p networking stack. Versions older than `v0.38.0` of js-libp2p are vulnerable to targeted resource exhaustion attacks. These attacks target libp2p’s connection, stream, peer, and memory management. A…
-
High 7.5
libp2p-rust denial of service vulnerability from lack of resource management
libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.45.1 an attacker node can cause a victim node to allocate a large number of small memory chunks, which can ultimately lead to the victim’s process …
-
High 7.5
IBM Content Navigator code execution
IBM Content Navigator 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, and 3.0.12 is vulnerable to missing authorization and could allow an authenticated user to load external plugins and execute code. IBM X-Force ID: 2388…
-
High 7.5
Restricted file access on Windows in os and net/http
On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permit access to Windows device files under that root. For example, …
-
High 8.8
Elevation of privilege in the Azure SQL Data Source in Devolutions Remote Desktop Manager 2022.3.13 to 2022.3.24 allows…
-
High 7.1
PaddlePaddle Out-of-bounds Read vulnerability
Out-of-bounds read in gather_tree in PaddlePaddle before 2.4.
-
High 8.7
Appliance mode iControl REST vulnerability
In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to…
-
High 8.8
iControl SOAP vulnerability
In all versions, BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
-
High 7.5
qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users to cause a denial of …
-
High 8.8
ILIAS before 7.16 allows OS Command Injection.
-
High 7.2
Online Leave Management System v1.0 was discovered to contain an arbitrary file upload vulnerability at /leave_system/c…
-
High 8.8
Authentication bypass vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to bypass au…
-
High 8.8
Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earl…
-
High 7.2
Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=services/view_service&id=.
-
High 8.8
A Cross-Site Request Forgery (CSRF) in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super…
-
High 7.5
Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.0.0 to 4.0.3 allows a remote authenticated a…
-
High 8.8
A stack overflow vulnerability exists in TrendNet Wireless AC Easy-Upgrader TEW-820AP (Version v1.0R, firmware version …
-
High 8.1
Casdoor arbitrary file deletion vulnerability via uploadFile function
Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function.
-
High 8.8
OS command injection vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier…
-
High 7.2
Improper neutralization of Server-Side Includes (SSW) within a web page in Movable Type series allows a remote authenti…
-
High 7.8
Out-of-bounds write vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure …
-
High 7.5
External initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and e…
-
High 7.8
Use-after free vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/o…
-
High 8.8
Hidden functionality vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier…
-
High 7.8
Stack-based buffer overflow vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information dis…