Archive
20 December 2022
Vulnerabilities first published on this day (UTC), newest first.
85 results · Feed
-
Medium 5.1
IBM Spectrum Control information disclosure
IBM Spectrum Control 5.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 233982.
-
Medium 4.4
IBM Security Guardium information disclosure
IBM Security Guardium 11.4 could allow a privileged user to obtain sensitive information inside of an HTTP response. IBM X-Force ID: 235405.
-
High 7.7
OpenFGA Authorization Bypass
OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered that OpenFGA version 0.3.0 is vulnerable to authorization bypass under certain conditions. This issue…
-
Medium 6.2
IBM AIX denial of service
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a local user with elevated privileges to exploit a vulnerability in the lpd daemon to cause a denial of service. IBM X-Force ID: 238641.
-
Medium 5.0
ghinstallation returns app JWT in error responses
ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1, when the request to refresh an installation token failed, the HTTP request and response would be r…
-
Medium 4.6
IBM UrbanCode Deploy (UCD) cross-site scripting
IBM UrbanCode Deploy (UCD) 6.2.0.0 through 6.2.7.18, 7.0.5.0 through 7.0.5.13, 7.1.0.0 through 7.1.2.9, 7.2.0.0 through 7.2.3.2 and 7.3.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI…
-
Medium 6.5
PJSIP vulnerable to heap buffer overflow when decoding STUN message
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Buffer overread is possible when parsing a specially crafted STUN message with unknown att…
-
Medium 6.2
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms denial of service
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow an authenticated user to lock additional RM authorizations, resulting in a denial of service on displaying or managing these authorizations. IBM X-Force ID: 240034.
-
Medium 5.3
IBM Financial Transaction Manager information disclosure
IBM Financial Transaction Manager 3.2.4 authorization checks are done incorrectly for some HTTP requests which allows getting unauthorized technical information (e.g. event log entries) about the FTM SWIFT system. IBM X-Force ID: 239708.
-
Medium 5.5
Sidebar Widgets by CodeLights <= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
The Sidebar Widgets by CodeLights plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Extra CSS class’ parameter in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible fo…
-
High 8.8
Authentication bypass in local application lock feature in Devolutions Remote Desktop Manager 2022.3.26 and earlier on…
-
Critical 9.8
Apache Airflow Hive Provider: Hive Provider RCE vulnerability with hive_cli_params
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider: before 5.0.0.
-
Medium 6.4
HCL BigFix WebUI is affected by a missing-permission-check vulnerability
BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES Support external site.
-
High 7.8
A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A cr…
-
High 8.6
OnCommand Insight versions 7.3.1 through 7.3.14 are susceptible to an authentication bypass vulnerability in the Data W…
-
High 7.5
D-Link devices DAP-2310 v2.10rc036 and earlier, DAP-2330 v1.06rc020 and earlier, DAP-2360 v2.10rc050 and earlier, DAP-2…
-
High 7.5
Some smartphones have the input validation vulnerability. Successful exploitation of this vulnerability may affect data…
-
Critical 9.8
A thread security vulnerability exists in the authentication process. Successful exploitation of this vulnerability may…
-
High 7.5
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the security_5g parameter at /goform/WifiBasicSet.
-
Critical 9.8
The kernel module has an out-of-bounds read vulnerability. Successful exploitation of this vulnerability may cause memo…
-
Critical 9.8
Some smartphones have configuration issues. Successful exploitation of this vulnerability may cause privilege escalatio…
-
High 7.5
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/NatStaticSetting.
-
Critical 9.8
Tenda F1203 V2.0.1.6 was discovered to contain a command injection vulnerability via the mac parameter at /goform/Write…
-
High 7.5
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the limitSpeed parameter at /goform/SetClientState.
-
Unscored —
The application management module has a vulnerability in permission verification. Successful exploitation of this vulne…
-
High 7.5
The power consumption module has an out-of-bounds read vulnerability. Successful exploitation of this vulnerability may…
-
High 7.5
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the security parameter at /goform/WifiBasicSet.
-
High 7.5
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceMac parameter at /goform/addWifiMacFilte…
-
Critical 9.8
Some smartphones have the out-of-bounds write vulnerability. Successful exploitation of this vulnerability may cause sy…
-
Medium 5.3
The sensor privacy module has an authentication vulnerability. Successful exploitation of this vulnerability may cause …
-
High 7.5
The contacts component has a free (undefined) provider vulnerability. Successful exploitation of this vulnerability may…
-
Critical 9.8
Some smartphones have the out-of-bounds write vulnerability. Successful exploitation of this vulnerability may cause sy…
-
High 7.5
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceId parameter at /goform/SetClientState.
-
High 7.5
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the ssid parameter at /goform/fast_setting_wifi_se…
-
High 7.5
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceId parameter at /goform/saveParentContro…
-
High 8.8
An issue in the firmware update process of TP-Link TL-WA901ND V1 up to v3.11.2 and TL-WA901N V2 up to v3.12.16 allows a…
-
High 7.5
The TelephonyProvider module has a vulnerability in obtaining values.Successful exploitation of this vulnerability may …
-
High 7.5
The ProfileSDK has defects introduced in the design process. Successful exploitation of this vulnerability may affect s…
-
High 8.8
An issue in the firmware update process of TP-LINK TL-WA801N / TL-WA801ND V1 v3.12.16 and earlier allows attackers to e…
-
High 8.1
An exploitable firmware modification vulnerability was discovered on the Netgear XWN5001 Powerline 500 WiFi Access Poin…