Archive
9 February 2023
Vulnerabilities first published on this day (UTC), newest first.
54 results · Clear filters · Feed
-
Medium 5.5
dimtion Shaarlier Tag TagsSource.java createTag sql injection
A vulnerability was found in dimtion Shaarlier up to 1.2.2. It has been declared as critical. Affected by this vulnerability is the function createTag of the file app/src/main/java/com/dimtion/shaarlier/TagsSource.java of the component Tag Handler. The manipu…
-
Medium 5.9
Denial of service in HAMT Decoding in go-unixfs
go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. T…
-
Medium 5.9
Denial of service when feeding malformed size arguments in go-bitfield
go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library. When feeding untrusted user input into the size parameter of `NewBitfield` and `FromBytes` functions, an attacker can trigger `panic`s. This h…
-
Medium 5.9
HAMT Decoding Panics in github.com/ipfs/go-unixfsnode
github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2 trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you ar…
-
Medium —
bottlerocket dependency openssl has a double free vulnerability
A timing based side channel exists in the OpenSSL RSA decryption implementation which could enable a recovery of plaintext from across the network. This affects all RSA padding modes. A server agent compiled with OpenSSL could be made to give up plaintext pay…
-
Medium —
bottlerocket dependency openssl has a double free vulnerability
A double-free vulnerability exists in OpenSSL where it is possible to construct a malicious PEM file that has 0 bytes of payload data. This then points to data that has already been freed in memory which, when freed again, leads to a crash. Agents or clients …
-
Medium —
bottlerocket dependency openssl is vulnerable to read buffer overflow via X.509 verification
A read buffer overflow can be triggered in OpenSSL X.509 verification during name constraint checking. Note that this occurs after the certificate chain has been verified and would require a compromised CA. This can cause a client or agent compiled with OpenS…
-
Medium 6.0
`pnet_packet` buffer overrun in `set_payload` setters
As indicated by this [issue](https://github.com/libpnet/libpnet/issues/449#issuecomment-663355987), a buffer overrun is possible in the `set_payload` setter of the various mutable "Packet" struct setters. The offending `set_payload` functions were defined wit…
-
Medium —
bottlerocket dependency openssl provides streaming of ASN.1 data via a BIO
An OpenSSL public API provides streaming of ASN.1 data via a BIO. It is possible for a malicious third party to use the BIO to access unfreed memory pointers that are not cleaned up after execution of the API. Freeing these memory pointers will result in a cr…
-
Medium 4.8
Disclosure of classpath resources on Windows when mounted on a wildcard route in vertx-web
Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications that serve files using `StaticHandler` on Windows Operating Systems and Windows File Systems, if the mount point is a wi…
-
Medium 6.7
Arbitrary File Write in High Availability Backup Upload
The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary files through the backup upload endpoint by using path traversal characters. This vulnerability is associated with program files PlatformReplicationManager.Java. This is…
-
Medium 6.8
Server-Side Request Forgery
Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentication Attempts vulnerability in YugaByte, Inc. Yugabyte Managed allows Accessing Functionality Not P…
-
Medium 6.3
glorylion JFinalOA SysOrg.java sql injection
A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical. This issue affects some unknown processing of the file src/main/java/com/pointlion/mvc/common/model/SysOrg.java. The manipulation of the argument id leads to sql injection. The …
-
Medium 6.7
Use of out-of-range pointer offset in Audio
Memory corruption in Audio due to use of out-of-range pointer offset while Initiating a voice call session from user space with invalid session id.
-
Medium 6.7
Use after free in Trusted Application Environment
Memory corruption due to use after free in trusted application environment.
-
Medium 6.8
Buffer over-read in Trusted Execution Environment
Information disclosure in Trusted Execution Environment due to buffer over-read while processing metadata verification requests.
-
Medium 6.0
Improper Input Validation in Automotive
Transient Denial-of-service in Automotive due to improper input validation while parsing ELF file.
-
Medium 5.3
Privilege Chaining in cockpit-hq/cockpit
Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8.
-
Medium 6.1
OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is …
-
Medium 4.8
An issue in the CSV Import function of ChurchCRM v4.5.3 and below allows attackers to execute arbitrary code via import…
-
Medium 6.1
A reflected cross-site scripting (XSS) vulnerability in the FileDialog.aspx component of mojoPortal v2.7.0.0 allows att…
-
Medium 5.4
ChurchCRM 4.5.3 and below was discovered to contain a stored cross-site scripting (XSS) vulnerability at /api/public/re…
-
Medium 5.4
Mojoportal v2.7.0.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Company Info Set…
-
Medium 5.3
An issue in Mojoportal v2.7.0.0 allows an unauthenticated attacker to register a new user even if the Allow User Regist…
-
Medium 4.3
An issue in Mojoportal v2.7.0.0 and below allows an authenticated attacker to list all css files inside the root path o…
-
Medium 4.4
Exposure of Sensitive Information vulnerability in Fingerprint TA prior to SMR Feb-2023 Release 1 allows attackers to a…
-
Medium 5.9
Improper Handling of Insufficient Permissions or Privileges vulnerability in KnoxCustomManagerService prior to SMR Jan-…
-
Medium 4.3
Improper access control vulnerability in telecom application prior to SMR JAN-2023 Release 1 allows local attackers to …
-
Medium 6.2
Improper access control vulnerability in WindowManagerService prior to SMR Feb-2023 Release 1 allows attackers to take …
-
Medium 5.1
Improper authorization vulnerability in ChnFileShareKit prior to SMR Jan-2023 Release 1 allows attacker to control BLE …
-
Medium 5.4
Improper access control vulnerability in NfcTile prior to SMR Jan-2023 Release 1 allows to attacker to use NFC without …
-
Medium 6.2CVE-2023-21434 EPSS 13%
Improper input validation vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to execute Jav…
-
Medium 5.7
Path traversal vulnerability in Samsung Cloud prior to version 5.3.0.32 allows attacker to access specific png file.
-
Medium 4.0
Improper access control vulnerability in Phone application prior to SMR Feb-2023 Release 1 allows local attackers to ac…
-
Medium 6.7
A Stack-based overflow vulnerability in IpcRxEmbmsSessionList in SECRIL prior to Android S(12) allows attacker to cause…
-
Medium 4.3
An improper implementation logic in Secure Folder prior to SMR Jan-2023 Release 1 allows the Secure Folder container re…
-
Medium 4.3
Hardcoded AES key to encrypt cardemulation PINs in NFC prior to SMR Jan-2023 Release 1 allows attackers to access carde…
-
Medium 4.4
An out-of-bound read vulnerability in mapToBuffer function in libSDKRecognitionText.spensdk.samsung.so library prior to…
-
Medium 4.2
Improper access control vulnerabilities in Smart Things prior to 1.7.93 allows to attacker to invite others without aut…
-
Medium 4.0
Improper usage of implict intent in ePDG prior to SMR JAN-2023 Release 1 allows attacker to access SSID.