Archive
7 February 2023
Vulnerabilities first published on this day (UTC), newest first.
84 results · Feed
-
Medium 6.8
NVIDIA GeForce Experience contains an uncontrolled search path vulnerability in all its client installers, where an att…
-
High 8.2
NVIDIA GeForce Experience contains a vulnerability in the installer, where a user installing the NVIDIA GeForce Experie…
-
Medium 6.5
Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in syft
syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFT_ATTEST_PAS…
-
Medium 5.3
Denial Of Service when opening a corrupt PDF file in pdfio
PDFio is a C library for reading and writing PDF files. In versions prior to 1.1.0 a denial of service (DOS) vulnerability exists in the pdfio parser. Crafted pdf files can cause the program to run at 100% utilization and never terminate. The pdf which causes…
-
Medium 6.5
Cross-Site Request Forgery (CSRF) in wallabag/wallabag
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4.
-
Unscored —
Heap buffer overflow in WebUI in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to…
-
Medium 6.5
Inappropriate implementation in Download in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potential…
-
Unscored —
Type confusion in V8 in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corr…
-
High 8.8
Use after free in GPU in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap cor…
-
Medium 6.5
Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to bypass…
-
Unscored —
Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 110.0.5481.77 allowed a remote at…
-
High 8.8
Out of bounds read in WebRTC in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to perform an out of bou…
-
Unscored —
Type confusion in Data Transfer in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user …
-
High 7.5
Integer overflow in Core in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who had one a race condition…
-
Unscored —
Type confusion in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to en…
-
Medium 4.6
Cross-site Scripting (XSS) - Stored in wallabag/wallabag
Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4.
-
Medium 6.1
Cross site scripting (XSS) vulnerability in sourcecodester oretnom23 sales management system 1.0, allows attackers to e…
-
Medium 6.1
Cross Site Scripting (XSS) vulnerability in InvoicePlane 1.6 via filter_product input to file modal_product_lookups.php.
-
Medium 6.3
libzypp-plugin-appdata: potential arbitrary code execution via shell injection due to `os.system` calls
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in libzypp-plugin-appdata of SUSE Linux Enterprise Server for SAP 15-SP3; openSUSE Leap 15.4 allows attackers that can trick users to use specially cra…
-
High 8.8
A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to com…
-
High 7.2
A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4…
-
High 7.5
[RANCHER] OS command injection in Rancher and Fleet
A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in wrangler of SUSE Rancher allows remote attackers to inject commands in the underlying host via crafted commands passed to Wrangler. This issue affect…
-
High 7.8
rmt-server-pubcloud allows to escalate from user _rmt to root
A Incorrect Default Permissions vulnerability in rmt-server-regsharing service of SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Server for SAP 15-SP1, SUSE Manager Server 4.1; openSUSE Leap 15.3, openSUSE Leap 15.4 allows local attackers with…
-
Critical 9.8
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Age…
KEV Feb 10, 2023 -
High 7.5
A flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-file condition …
-
High 7.5
In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal.
-
Medium 6.5
An issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can cause a denial of serv…
-
Medium 6.5
An issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can cause a denial of serv…
-
Medium 6.1
A cross-site scripting (XSS) vulnerability in Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.13)C0, which coul…
-
High 8.8
Insecure Permission vulnerability in Schlix Web Inc SCHLIX CMS 2.2.7-2 allows attacker to upload arbitrary files and ex…
-
Medium 4.3
An improper check for unusual conditions in Zyxel NWA110AX firmware verisons prior to 6.50(ABTG.0)C0, which could allow…
-
High 8.8CVE-2022-45768 EPSS 29%
Command Injection vulnerability in Edimax Technology Co., Ltd. Wireless Router N300 Firmware BR428nS v3 allows attacker…
-
Medium 5.3
An issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can bypass passkey entry i…
-
Medium 6.5
Nordic Semiconductor, Microchip Technology NRF5340-DK DT100112 was discovered to contain an issue which allows attacker…
-
Medium 4.3
paste: XSS on the image upload function
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in paste allows remote attackers to place Javascript into SVG files. This issue affects: openSUSE paste paste version b57b9f87e303a3db9465776e657378e96845493…
-
High 7.4
Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster
A Missing Authorization vulnerability in of SUSE Rancher allows authenticated user to create an unauthorized shell pod and kubectl access in the local cluster This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10;…
-
High 7.1
Rancher: Non-random authentication token
A Insufficient Entropy vulnerability in SUSE Rancher allows attackers that gained knowledge of the cattle-token to continue abusing this even after the token was renewed. This issue affects: SUSE Rancher Rancher versions prior to 2.6.10; Rancher versions prio…
-
High 7.6
Rancher: Command injection in Git package
A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SUSE Rancher allows code execution for user with the ability to add an untrusted Helm catalog or modifying the URL configuration used to download KDM…
-
Critical 9.9
Rancher: Exposure of sensitive fields
A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows users on managed clusters to gain access to credentials. The impact depends on the credentials exposed This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher…
-
High 7.2
Rancher: Privilege escalation via promoted roles
A Improper Privilege Management vulnerability in SUSE Rancher, allows users with access to the escalate verb on PRTBs to escalate permissions for any -promoted resource in any cluster. This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher…