Archive
January 2023
Vulnerabilities first published in this month (UTC), newest first.
2,382 results · Feed
-
High 7.5
Junos OS: MX Series and SRX Series: The flow processing daemon (flowd) will crash if SIP ALG is enabled and a malformed SIP packet is received
A Buffer Overflow vulnerability in SIP ALG of Juniper Networks Junos OS allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). On all MX Series and SRX Series platform with SIP ALG enabled, when a malformed SIP packet is received…
-
High 7.5
Junos OS: MX Series with MPC10/MPC11: When Suspicious Control Flow Detection (scfd) is enabled and an attacker is sending specific traffic, this causes a memory leak.
A Missing Release of Memory after Effective Lifetime vulnerability in the Juniper Networks Junos OS on MX Series platforms with MPC10/MPC11 line cards, allows an unauthenticated adjacent attacker to cause a Denial of Service (DoS). Devices are only vulnerable…
-
Medium 6.5
Junos OS: SRX Series and MX Series with SPC3: When IPsec VPN is configured iked will core when a specifically formatted payload is received
An Out-of-bounds Write vulnerability in the Internet Key Exchange Protocol daemon (iked) of Juniper Networks Junos OS on SRX series and MX with SPC3 allows an authenticated, network-based attacker to cause a Denial of Service (DoS). iked will crash and restar…
-
Medium 5.5
Junos OS: SRX Series, MX Series with SPC3: When an inconsistent NAT configuration exists and a specific CLI command is issued the SPC will reboot
An Unchecked Input for Loop Condition vulnerability in a NAT library of Juniper Networks Junos OS allows a local authenticated attacker with low privileges to cause a Denial of Service (DoS). When an inconsistent "deterministic NAT" configuration is present o…
-
Medium 6.5
Junos OS: QFX5k Series, EX46xx Series: MAC limiting feature stops working after PFE restart or device reboot
An Improper Preservation of Consistency Between Independent Representations of Shared State vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS) to dev…
-
Medium 6.5
Junos OS: PTX Series and QFX10000 Series: An FPC memory leak is observed when specific EVPN VXLAN Multicast packets are processed
A Missing Release of Memory after Effective Lifetime vulnerability in Flexible PIC Concentrator (FPC) of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker from the same shared physical or logical network, to cause a heap memory leak and l…
-
Medium 5.9
Junos OS Evolved: The kernel might restart in a BGP scenario where "bgp auto-discovery" is enabled and such a neighbor flaps
A Use After Free vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). In a Non Stop Routing (NSR) scenario, an unexpected kernel restart might be observed if "bg…
-
Critical 9.8
EXFO - BV-10 Performance Endpoint Unit Undocumented privileged user.
EXFO - BV-10 Performance Endpoint Unit Undocumented privileged user. Unit has an undocumented hard-coded privileged user.
-
Medium 6.5
Moodle Plugin - SAML Auth Open Redirect
Moodle Plugin - SAML Auth may allow Open Redirect through unspecified vectors.
-
Medium 6.2
EXFO - BV-10 Performance Endpoint Unit Misconfiguration
EXFO - BV-10 Performance Endpoint Unit misconfiguration. System configuration file has misconfigured permissions
-
Medium 6.8
Rumpus - FTP server Reflected cross-site scripting (RXSS)
Rumpus - FTP server version 9.0.7.1 has a Reflected cross-site scripting (RXSS) vulnerability through unspecified vectors.
-
Medium 4.9
H C Mingham-Smith Ltd - Tardis 2000 Privilege escalation
H C Mingham-Smith Ltd - Tardis 2000 Privilege escalation.Version 1.6 is vulnerable to privilege escalation which may allow a malicious actor to gain system privileges.
-
Critical 9.8
EXFO - BV-10 Performance Endpoint Unit Authentication bypass
EXFO - BV-10 Performance Endpoint Unit authentication bypass User can manually manipulate access enabling authentication bypass.
-
Medium 5.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 15.5.7, all versions star…
-
Medium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 15.5.7, all versions star…
-
Medium 6.3
Infinite loops in the BPv6, OpenFlow, and Kafka protocol dissectors in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allo…
-
Medium 6.4
An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 befo…
-
High 7.5
A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnera…
-
Medium 5.3
Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and…
-
Medium 5.5
A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attr_punch_hole() was found. A local user cou…
-
Medium 5.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 before 15.5.7, all versions star…
-
Critical 9.8
A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability ca…
-
Medium 6.6
A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user conn…
-
Medium 4.7
@okta/oidc-middlewareOpen Redirect vulnerability
An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL.
-
Medium 5.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 15.5.7, all versions star…
-
Medium 5.8
An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 befo…
-
Medium 5.4
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions star…
-
Medium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions start…
-
Medium 4.3
A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines…
-
High 7.8
A use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol) functionality. This …
-
Medium 6.5
A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' esc…
-
Medium 5.3
A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c fi…
-
Medium 6.8
Rumpus - FTP server Cross-site request forgery (CSRF) – Privilege escalation
Rumpus - FTP server Cross-site request forgery (CSRF) – Privilege escalation vulnerability that may allow privilege escalation.
-
Medium 6.8
Rumpus - FTP server Cross-site request forgery (CSRF) – Create user
Rumpus - FTP server version 9.0.7.1 Cross-site request forgery (CSRF) – vulnerability may allow unauthorized action on behalf of authenticated users.
-
High 7.2
Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /hss/cl…
-
Medium 6.8
Rumpus - FTP server Persistent cross-site scripting (PXSS) – Unspecified vector
Rumpus - FTP server version 9.0.7.1 Persistent cross-site scripting (PXSS) – vulnerability may allow inserting scripts into unspecified input fields.
-
Medium 5.4
A cross-site scripting (XSS) vulnerability in the component /admin/register.php of Online Student Enrollment System v1.…
-
Medium 5.4
A cross-site scripting (XSS) vulnerability in the /admin/article_category.php component of DouPHP v1.7 20221118 allows …
-
High 7.8CVE-2022-46623 Public exploit
Judging Management System v1.0.0 was discovered to contain a SQL injection vulnerability via the username parameter.
-
Medium 5.3
Alotcer - AR7088H-A Information disclosure
Alotcer - AR7088H-A firmware version 16.10.3 Information disclosure. Unspecified error message contains the default administrator user name.