Archive
9 February 2023
Vulnerabilities first published on this day (UTC), newest first.
125 results · Feed
-
High 8.8
ImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to PHAR Deserialization
The ImageMagick Engine plugin for WordPress is vulnerable to deserialization of untrusted input via the 'cli_path' parameter in versions up to, and including 1.7.5. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted t…
-
Medium 5.5
dimtion Shaarlier Tag TagsSource.java createTag sql injection
A vulnerability was found in dimtion Shaarlier up to 1.2.2. It has been declared as critical. Affected by this vulnerability is the function createTag of the file app/src/main/java/com/dimtion/shaarlier/TagsSource.java of the component Tag Handler. The manipu…
-
Medium 5.9
Denial of service in HAMT Decoding in go-unixfs
go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. T…
-
Medium 5.9
Denial of service when feeding malformed size arguments in go-bitfield
go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library. When feeding untrusted user input into the size parameter of `NewBitfield` and `FromBytes` functions, an attacker can trigger `panic`s. This h…
-
High 7.5
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in System Configuration Tool (SCT)
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.
-
High 7.5
Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT)
Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.
-
Medium 5.9
HAMT Decoding Panics in github.com/ipfs/go-unixfsnode
github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2 trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you ar…
-
High —
bottlerocket dependency openssl is vulnerable to dereferenced null pointers
A null pointer in OpenSSL can be dereferenced when signatures are being verified in malformed PKCS7 data. Agents or clients compiled with OpenSSL may experience unexpected crashes. OpenSSL has been removed in bottlerocket/update-operator version 1.1.0 in favo…
-
Medium —
bottlerocket dependency openssl has a double free vulnerability
A timing based side channel exists in the OpenSSL RSA decryption implementation which could enable a recovery of plaintext from across the network. This affects all RSA padding modes. A server agent compiled with OpenSSL could be made to give up plaintext pay…
-
Medium —
bottlerocket dependency openssl has a double free vulnerability
A double-free vulnerability exists in OpenSSL where it is possible to construct a malicious PEM file that has 0 bytes of payload data. This then points to data that has already been freed in memory which, when freed again, leads to a crash. Agents or clients …
-
Medium —
bottlerocket dependency openssl is vulnerable to read buffer overflow via X.509 verification
A read buffer overflow can be triggered in OpenSSL X.509 verification during name constraint checking. Note that this occurs after the certificate chain has been verified and would require a compromised CA. This can cause a client or agent compiled with OpenS…
-
Medium 6.0
`pnet_packet` buffer overrun in `set_payload` setters
As indicated by this [issue](https://github.com/libpnet/libpnet/issues/449#issuecomment-663355987), a buffer overrun is possible in the `set_payload` setter of the various mutable "Packet" struct setters. The offending `set_payload` functions were defined wit…
-
Medium —
bottlerocket dependency openssl provides streaming of ASN.1 data via a BIO
An OpenSSL public API provides streaming of ASN.1 data via a BIO. It is possible for a malicious third party to use the BIO to access unfreed memory pointers that are not cleaned up after execution of the API. Freeing these memory pointers will result in a cr…
-
Medium 4.8
Disclosure of classpath resources on Windows when mounted on a wildcard route in vertx-web
Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications that serve files using `StaticHandler` on Windows Operating Systems and Windows File Systems, if the mount point is a wi…
-
High 7.2
Remote Code Execution
External Control of Critical State Data, Improper Control of Generation of Code ('Code Injection') vulnerability in YugaByte, Inc. Yugabyte DB on Windows, Linux, MacOS, iOS (DevopsBase.Java:execCommand, TableManager.Java:runCommand modules) allows API Manipul…
-
Medium 6.7
Arbitrary File Write in High Availability Backup Upload
The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary files through the backup upload endpoint by using path traversal characters. This vulnerability is associated with program files PlatformReplicationManager.Java. This is…
-
Medium 6.8
Server-Side Request Forgery
Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentication Attempts vulnerability in YugaByte, Inc. Yugabyte Managed allows Accessing Functionality Not P…
-
Medium 6.3
glorylion JFinalOA SysOrg.java sql injection
A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical. This issue affects some unknown processing of the file src/main/java/com/pointlion/mvc/common/model/SysOrg.java. The manipulation of the argument id leads to sql injection. The …
-
Critical 9.8
SQL Injection in Smartpower Web
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Group Arge Energy and Control Systems Smartpower Web allows SQL Injection. This issue affects Smartpower Web: before 23.01.01.
-
High 8.8
Privilege escalation via manipulated unixcat executable
Uncontrolled Search Path Element in Checkmk Agent in Tribe29 Checkmk before 2.1.0p1, before 2.0.0p25 and before 1.6.0p29 on a Checkmk server allows the site user to escalate privileges via a manipulated unixcat executable
-
Critical 9.8
Buffer copy without checking size of input in WLAN Firmware
Memory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in reassoc response frame.
-
High 7.5
Uncontrolled resource consumption in WLAN Firmware.
Transient DOS due to uncontrolled resource consumption in WLAN firmware when peer is freed in non qos state.
-
High 7.5
Buffer over-read in WLAN Firmware.
Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon.
-
High 7.5
Improper input validation in WLAN Host
Transient DOS due to improper input validation in WLAN Host.
-
High 7.5
Improper input validation in WLAN Host
Transient DOS due to improper input validation in WLAN Host while parsing frame during defragmentation.
-
High 7.5
Buffer over-read in WLAN Host
Transient DOS due to buffer over-read in WLAN Host while parsing frame information.
-
High 7.5
Buffer over-read in WLAN
Transient DOS due to buffer over-read in WLAN while processing an incoming management frame with incorrectly filled IEs.
-
High 7.3
Access of uninitialized pointer in Bluetooth HOST
Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet.
-
Critical 9.8
Stack based buffer overflow in WLAN
Memory corruption due to stack based buffer overflow in WLAN having invalid WNM frame length.
-
High 8.4
Buffer copy without checking size of input in modem
Memory corruption in modem due to buffer copy without checking size of input while receiving WMI command.
-
High 8.2
Buffer over-read in WLAN
Information disclosure due to buffer over-read in WLAN while parsing NMF frame.
-
High 7.8
Integer overflow to buffer overflow in User Identity Module
Memory corruption in User Identity Module due to integer overflow to buffer overflow when a segement is received via qmi http.
-
Medium 6.7
Use of out-of-range pointer offset in Audio
Memory corruption in Audio due to use of out-of-range pointer offset while Initiating a voice call session from user space with invalid session id.
-
High 8.4
Improper access control in Qualcomm IPC
Memory corruption due to improper access control in Qualcomm IPC.
-
High 7.8
Configuration weakness in modem
Memory corruption due to configuration weakness in modem wile sending command to write protected files.
-
Critical 9.3
Buffer copy without checking size of input in Hypervisor
Memory corruption due to buffer copy without checking size of input while running memory sharing tests with large scattered memory.
-
High 8.2
Buffer over-read in Modem
Information disclosure due to buffer over-read in Modem while using static array to process IPv4 packets.
-
Medium 6.7
Use after free in Trusted Application Environment
Memory corruption due to use after free in trusted application environment.
-
Medium 6.8
Buffer over-read in Trusted Execution Environment
Information disclosure in Trusted Execution Environment due to buffer over-read while processing metadata verification requests.
-
Medium 6.0
Improper Input Validation in Automotive
Transient Denial-of-service in Automotive due to improper input validation while parsing ELF file.