Archive
August 2023
Vulnerabilities first published in this month (UTC), newest first.
2,514 results · Feed
-
High 7.8
A vulnerability has been identified in JT Open (All versions < V11.4), JT Utilities (All versions < V13.4). The affecte…
-
High 7.8
A vulnerability has been identified in JT Open (All versions < V11.4), JT Utilities (All versions < V13.4), Parasolid V…
-
High 7.8
A vulnerability has been identified in JT2Go (All versions < V14.2.0.5), Solid Edge SE2022 (All versions < V222.0 Updat…
-
High 8.8
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.4). The affected applications is vulnerabl…
-
Critical 9.1
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i8…
-
High 7.8
A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.10). Affected applications do not properly …
-
High 7.8
A vulnerability has been identified in Siemens Software Center (All versions < V3.0). A DLL Hijacking vulnerability cou…
-
Medium 6.7
Multiple Dmabuf Kernel Address UAF Vulnerability
In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which caus…
-
Medium 6.4
Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Kernel Driver
The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it. In other words, user mode may race and modify the packet header (e.g. header.count), causing checks (e.g. size checks) in kernel…
-
Medium 6.7
Multiple Type Confusion Vulnerability
The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it.
-
Critical 9.8
Buffer Copy Without Checking Size of Input in QESL
Memory corruption in QESL while processing payload from external ESL device to firmware.
-
High 7.5
Buffer Over-read in Audio
Transient DOS in Audio while remapping channel buffer in media codec decoding.
-
High 8.4
Integer Overflow or Wraparound in Audio
Memory corruption while allocating memory in COmxApeDec module in Audio.
-
High 8.4
Integer Overflow or Wraparound in Audio
Memory Corruption in Audio while playing amrwbplus clips with modified content.
-
High 7.7
Key Management Errors in HLOS
Cryptographic issue in HLOS as derived keys used to encrypt/decrypt information is present on stack after use.
-
Critical 9.3
Incorrect Type Conversion or Cast in Core
Memory Corruption in Core due to incorrect type conversion or cast in secure_io_read/write function in TEE.
-
Medium 6.7
Improper Validation of Array Index in GPS HLOS Driver
Memory Corruption in GPS HLOS Driver when injectFdclData receives data with invalid data length.
-
Medium 6.7
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN
Memory corruption in WLAN while running doDriverCmd for an unspecific command.
-
Medium 6.7
Integer Overflow to Buffer Overflow in RIL
Memory corruption in RIL while trying to send apdu packet.
-
Medium 6.5
Improper Input Validation in Bluetooth HOST
Information disclosure in Bluetooth when an GATT packet is received due to improper input validation.
-
Critical 9.1
Untrusted Pointer Dereference in Automotive
Memory corruption due to untrusted pointer dereference in automotive during system call.
-
Medium 6.7
Incorrect Type Conversion or Cast in Trusted Execution Environment
Memory corruption in Trusted Execution Environment while calling service API with invalid address.
-
High 7.1
Improper Authentication in HLOS.
Cryptographic issue in HLOS due to improper authentication while performing key velocity checks using more than one key.
-
High 8.2
Buffer Over-read in Network Services
Information disclosure in Network Services due to buffer over-read while the device receives DNS response.
-
Critical 9.8
Buffer copy without checking size of input in Audio.
Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder.
-
Critical 9.8
SQLi in mAyaNets E-Commerce Software
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mAyaNet E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: before 1.1.
-
High 7.2
Privilege Escalation for Project Owner and Project User Admin Roles in Ops Manager
In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation.
-
High 7.2
Insufficient Session Expiration Vulnerability in Emagic Data Center Management Suite
This vulnerability exists in ESDS Emagic Data Center Management Suit due to non-expiry of session cookie. By reusing the stolen cookie, a remote attacker could gain unauthorized access to the targeted system.
-
High 8.8
OS Command Injection Vulnerability in Emagic Data Center Management Suite
This vulnerability exists in ESDS Emagic Data Center Management Suit due to lack of input sanitization in its Ping component. A remote authenticated attacker could exploit this by injecting OS commands on the targeted system. Successful exploitation of this v…
-
Medium 4.9
PHOENIX CONTACT: Denial-of-Service due to malicious XML files in TC ROUTER, TC CLOUD CLIENT and CLOUD CLIENT
In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an authenticated remote attacker with admin privileges could upload a crafted XML file which causes a denial-of-service.
-
Critical 9.6
PHOENIX CONTACT: Cross-site Scripting vulnerability in TC ROUTER, TC CLOUD CLIENT and CLOUD CLIENT devices
In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an unauthenticated remote attacker could use a reflective XSS within the license viewer page of the devices in order to execute …
-
High 8.8
PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a specific HTTP DELETE request to gain full access to the device.
-
Critical 10.0
PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote, unauthenticated attacker may use an attribute of a specific HTTP POST request releated to date/time operations to gain full access to the device.
-
High 8.8
PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a specific HTTP POST releated to certificate operations to gain full access to the device.
-
High 8.8
PHOENIX CONTACT: Command Injection in WP 6xxx Web panels
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a command injection in a HTTP POST request releated to font configuration operations to gain full access to the device.
-
Medium 5.9
Information Disclosure vulnerability in SAP Commerce (OCC API)
Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access information which would otherwise be restricted. On successful exploitation there could be a high impact on confidential…
-
Medium 4.4
Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform
In SAP BusinessObjects Business Intelligence - version 420, If a user logs in to a particular program, under certain specific conditions memory might not be cleared up properly, due to which attacker might be able to get access to user credentials. For a succ…
-
High 8.8
SAP Commerce accepts empty passphrases.
SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase.
-
High 7.6
Cross-Site Scripting (XSS) vulnerability in SAP Business One
SAP business One allows - version 10.0, allows an attacker to insert malicious code into the content of a web page or application and gets it delivered to the client, resulting to Cross-site scripting. This could lead to harmful action affecting the Confident…
-
Medium 5.8
Information Disclosure in SAP Supplier Relationship Management
SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616, 617, allows an unauthorized attacker to discover information relating to SRM within Vendor Master Data for Business Partners replication functionality.This information could be …