Archive
February 2023
Vulnerabilities first published in this month (UTC), newest first.
731 results · Clear filters · Feed
-
High 7.8
Adobe Premiere Rush PSD files Use After Free Arbitrary code execution
Adobe Premiere Rush version 2.6 (and earlier) is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a mal…
-
High 7.8
Infoblox BloxOne Endpoint for Windows through 2.2.7 allows DLL injection that can result in local privilege escalation.
-
High 8.8
Arris TG2482A firmware through 9.1.103GEM9 allow Remote Code Execution (RCE) via the ping utility feature.
-
High 8.6
ClamAV Double-free Vulnerability in the OLE2 File Parser
A vulnerability in the OLE2 file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device.The vulnerability is due to incorrect use of the r…
-
High 8.8
Permissions vulnerability in LIZHIFAKA v.2.2.0 allows authenticated attacker to execute arbitrary commands via the set …
-
High 7.8
Buffer Overflow vulnerability in Dvidelabs flatcc v.0.6.0 allows local attacker to execute arbitrary code via the fltac…
-
High 7.5
An issue discovered in OpenKM v6.3.10 allows attackers to obtain sensitive information via the XMLTextExtractor functio…
-
High 8.8
Server-Side Request Forgery in Plone CMS
An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5.1.2, 5.1.1 5.1, 5.0rc3, 5.0rc2, 5.0rc1, 5.0.9, 5.0.8, 5.0.7, 5.0.6, 5.0.5, 5.0.4, 5.0.3, 5.0.2, 5.0.10, 5.0.1, 5.0, 4.…
-
High 7.7
Moby HyperKit uninitialized memory use vtrnd pci_vtrnd_notify
HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, the implementation of `qnotify` at `pci_vtrnd_notify` fails to check the return value of `vq_getchain`. This leads to `struct iovec io…
-
High 7.7
Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_tx
HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107, function `pci_vtsock_proc_tx` in `virtio-sock` can lead to to uninitialized memory use. In this situation, there is a check for the return value to be less …
-
High 7.8
Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw_buffer…
-
High 7.5
SQL Injection vulnerability in Exponent-CMS v.2.6.0 fixed in 2.7.0 allows attackers to gain access to sensitive informa…
-
High 8.1
An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Servi…
-
High 7.8
Improper access control in some QATzip software maintained by Intel(R) before version 1.0.9 may allow an authenticated …
-
High 7.3
Incorrect default permissions in the software installer for some Intel(R) QAT drivers for Linux before version 4.17 may…
-
High 8.4
Improper access control in the Crypto API Toolkit for Intel(R) SGX before version 2.0 commit ID 91ee496 may allow an au…
-
High 7.2
Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using …
-
High 7.5
Out of bounds read in firmware for OpenBMC in some Intel(R) platforms before version 0.72 may allow unauthenticated use…
-
High 7.1
Improper input validation in the Intel(R) SUR software before version 2.4.8902 may allow an authenticated user to poten…
-
High 7.4
Improper input validation in the Intel(R) SUR software before version 2.4.8902 may allow an unauthenticated user to pot…
-
High 7.7
Improper access control in the Intel(R) SUR software before version 2.4.8902 may allow an unauthenticated user to poten…
-
High 8.2
Improper initialization in the Intel(R) Battery Life Diagnostic Tool software before version 2.2.0 may allow an authent…
-
High 8.2
Insufficient control flow management in the Intel(R) Battery Life Diagnostic Tool software before version 2.2.0 may all…
-
High 7.5
Description: Race condition in the Intel(R) DSA software before version 22.4.26 may allow an authenticated user to pote…
-
High 7.8
Protection mechanism failure in the Intel(R) DSA software before version 22.4.26 may allow an authenticated user to pot…
-
High 8.8
Active debug code in some Intel (R) SPS firmware before version SPS_E5_04.04.04.300.0 may allow an authenticated user t…
-
High 7.2
Improper initialization in the Intel(R) TXT SINIT ACM for some Intel(R) Processors may allow a privileged user to poten…
-
High 7.5
Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially …
-
High 7.5
Improper initialization in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially en…
-
High 7.5
Use after free in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable esca…
-
High 8.2
Improper access control in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially en…
-
High 7.3
Insufficient control flow management in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authe…
-
High 7.3
Improper neutralization in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user…
-
High 7.3
Path traversal in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to poten…
-
High 7.5
Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon Scalable Proc…
-
High 7.5
Insecure inherited permissions in the Intel(R) oneAPI Toolkits oneapi-cli before version 0.2.0 may allow an authenticat…
-
High 8.3
Insufficient visual distinction of homoglyphs presented to user in the Intel(R) oneAPI DPC++/C++ Compiler before versio…
-
High 8.3
Improper handling of Unicode encoding in source code to be compiled by the Intel(R) C++ Compiler Classic before version…
-
High 7.5
Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)
node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for web browsers and node.js-based servers. Prior to version 2.2.0, when using the non-default "fallback" crypto back-end, ECC operations in `node-jose` can trigger a De…
-
High 8.0
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface…