Archive
January 2023
Vulnerabilities first published in this month (UTC), newest first.
1,042 results · Clear filters · Feed
-
Medium 5.5
atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service b…
-
Medium 5.3
Upx: heap-buffer-overflow in packtmt::pack()
A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.
-
Medium 6.5
Junos OS and Junos OS Evolved: An RPD crash can happen due to an MPLS TE tunnel configuration change on a directly connected router
An Incomplete Cleanup vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS). An rpd crash can occur when an MPLS TE tunnel configura…
-
Medium 6.1
Junos OS Evolved: PTX10003: An attacker sending specific genuine packets will cause a memory leak in the PFE leading to a Denial of Service
An Allocation of Resources Without Limits or Throttling weakness in the memory management of the Packet Forwarding Engine (PFE) on Juniper Networks Junos OS Evolved PTX10003 Series devices allows an adjacently located attacker who has established certain prec…
-
Medium 6.5
Junos OS: In an MPLS scenario the processing of specific packets to the device causes a buffer leak and ultimately a loss of connectivity
A Missing Release of Memory after Effective Lifetime vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS). In an MPLS scenario specific packets destined to an Integrated Routi…
-
Medium 6.5
Junos OS and Junos OS Evolved: A memory leak which will ultimately lead to an rpd crash will be observed when a peer interface flaps continuously in a Segment Routing scenario using OSPF
A Missing Release of Memory after Effective Lifetime vulnerability in the kernel of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS). In a segment-routing scenario with OSPF as IGP,…
-
Medium 5.3
Junos OS and Junos OS Evolved: RPD might crash when MPLS ping is performed on BGP LSPs
An Access of Uninitialized Pointer vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a locally authenticated attacker with low privileges to cause a Denial of Service (DoS). When an MPLS ping is perfor…
-
Medium 6.5
Junos OS: SRX Series and MX Series with SPC3: When IPsec VPN is configured iked will core when a specifically formatted payload is received
An Out-of-bounds Write vulnerability in the Internet Key Exchange Protocol daemon (iked) of Juniper Networks Junos OS on SRX series and MX with SPC3 allows an authenticated, network-based attacker to cause a Denial of Service (DoS). iked will crash and restar…
-
Medium 5.5
Junos OS: SRX Series, MX Series with SPC3: When an inconsistent NAT configuration exists and a specific CLI command is issued the SPC will reboot
An Unchecked Input for Loop Condition vulnerability in a NAT library of Juniper Networks Junos OS allows a local authenticated attacker with low privileges to cause a Denial of Service (DoS). When an inconsistent "deterministic NAT" configuration is present o…
-
Medium 6.5
Junos OS: QFX5k Series, EX46xx Series: MAC limiting feature stops working after PFE restart or device reboot
An Improper Preservation of Consistency Between Independent Representations of Shared State vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS) to dev…
-
Medium 6.5
Junos OS: PTX Series and QFX10000 Series: An FPC memory leak is observed when specific EVPN VXLAN Multicast packets are processed
A Missing Release of Memory after Effective Lifetime vulnerability in Flexible PIC Concentrator (FPC) of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker from the same shared physical or logical network, to cause a heap memory leak and l…
-
Medium 5.9
Junos OS Evolved: The kernel might restart in a BGP scenario where "bgp auto-discovery" is enabled and such a neighbor flaps
A Use After Free vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). In a Non Stop Routing (NSR) scenario, an unexpected kernel restart might be observed if "bg…
-
Medium 6.5
Moodle Plugin - SAML Auth Open Redirect
Moodle Plugin - SAML Auth may allow Open Redirect through unspecified vectors.
-
Medium 6.2
EXFO - BV-10 Performance Endpoint Unit Misconfiguration
EXFO - BV-10 Performance Endpoint Unit misconfiguration. System configuration file has misconfigured permissions
-
Medium 6.8
Rumpus - FTP server Reflected cross-site scripting (RXSS)
Rumpus - FTP server version 9.0.7.1 has a Reflected cross-site scripting (RXSS) vulnerability through unspecified vectors.
-
Medium 4.9
H C Mingham-Smith Ltd - Tardis 2000 Privilege escalation
H C Mingham-Smith Ltd - Tardis 2000 Privilege escalation.Version 1.6 is vulnerable to privilege escalation which may allow a malicious actor to gain system privileges.
-
Medium 5.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 15.5.7, all versions star…
-
Medium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 15.5.7, all versions star…
-
Medium 6.3
Infinite loops in the BPv6, OpenFlow, and Kafka protocol dissectors in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allo…
-
Medium 6.4
An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 befo…
-
Medium 5.3
Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and…
-
Medium 5.5
A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attr_punch_hole() was found. A local user cou…
-
Medium 5.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 before 15.5.7, all versions star…
-
Medium 6.6
A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user conn…
-
Medium 4.7
@okta/oidc-middlewareOpen Redirect vulnerability
An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL.
-
Medium 5.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 15.5.7, all versions star…
-
Medium 5.8
An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 befo…
-
Medium 5.4
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions star…
-
Medium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions start…
-
Medium 4.3
A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines…
-
Medium 6.5
A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' esc…
-
Medium 5.3
A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c fi…
-
Medium 6.8
Rumpus - FTP server Cross-site request forgery (CSRF) – Privilege escalation
Rumpus - FTP server Cross-site request forgery (CSRF) – Privilege escalation vulnerability that may allow privilege escalation.
-
Medium 6.8
Rumpus - FTP server Cross-site request forgery (CSRF) – Create user
Rumpus - FTP server version 9.0.7.1 Cross-site request forgery (CSRF) – vulnerability may allow unauthorized action on behalf of authenticated users.
-
Medium 6.8
Rumpus - FTP server Persistent cross-site scripting (PXSS) – Unspecified vector
Rumpus - FTP server version 9.0.7.1 Persistent cross-site scripting (PXSS) – vulnerability may allow inserting scripts into unspecified input fields.
-
Medium 5.4
A cross-site scripting (XSS) vulnerability in the component /admin/register.php of Online Student Enrollment System v1.…
-
Medium 5.4
A cross-site scripting (XSS) vulnerability in the /admin/article_category.php component of DouPHP v1.7 20221118 allows …
-
Medium 5.3
Alotcer - AR7088H-A Information disclosure
Alotcer - AR7088H-A firmware version 16.10.3 Information disclosure. Unspecified error message contains the default administrator user name.
-
Medium 6.1CVE-2022-46622 Public exploit
A cross-site scripting (XSS) vulnerability in Judging Management System v1.0 allows attackers to execute arbitrary web …
-
Medium 6.1CVE-2022-45729 Public exploit
A cross-site scripting (XSS) vulnerability in Doctor Appointment Management System v1.0.0 allows attackers to execute a…