Archive
8 November 2023
Vulnerabilities first published on this day (UTC), newest first.
111 results · Feed
-
Medium 5.4
HCL Connections is vulnerable to reflected cross-site scripting
HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which contains the malicious script cod…
-
Critical 9.8CVE-2023-3959 EPSS 49%
Zavio IP Camera Stack-Based Buffer Overflow
Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to multiple instances of stack-based overflows. While processing XML elements from incoming network request…
-
Critical 9.8
Zavio IP Camera Stack-Based Buffer Overflow
Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to multiple instances of stack-based overflows. While parsing certain XML elements from incoming network r…
-
Critical 9.8
Zavio IP Camera Stack-Based Buffer Overflow
Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to multiple instances of stack-based overflows. During the processing and parsing of certain fields in XML …
-
High 8.8
Zavio IP Camera Stack-Based Buffer Overflow
Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to stack-based overflows. During the process of updating certain settings sent from incoming network reques…
-
High 8.8CVE-2023-4249 EPSS 13%
Zavio IP Camera Stack-Based Buffer Overflow
Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 has a command injection vulnerability in their implementation of their binaries and handling of network requests.
-
Medium 6.7
A buffer overflow was reported in the ReFlash module in some Lenovo Desktop products that may allow a local attacker wi…
-
Medium 6.7
A buffer overflow was reported in the WMISwSmi module in some Lenovo Desktop products that may allow a local attacker w…
-
Medium 6.7
A buffer overflow was reported in the UltraFunctionTable module in some Lenovo Desktop products that may allow a local …
-
Medium 4.4
A buffer over-read was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may …
-
Medium 6.7
A buffer overflow was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may a…
-
Medium 4.4
A buffer over-read was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a loca…
-
Medium 6.7
A memory leakage vulnerability was reported in the NvmramSmm SMM driver that may allow a local attacker with elevated p…
-
Medium 6.7
A memory leakage vulnerability was reported in the DustFilterAlertSmm SMM driver that may allow a local attacker with e…
-
Medium 6.7
A memory leakage vulnerability was reported in the 534D0740 DXE driver that may allow a local attacker with elevated pr…
-
Medium 6.7
A memory leakage vulnerability was reported in the 534D0140 DXE driver that may allow a local attacker with elevated pr…
-
Medium 6.7
A memory leakage vulnerability was reported in the SWSMI_Shadow DXE driver that may allow a local attacker with elevate…
-
Medium 6.7
A buffer overflow was reported in the Update_WMI module in some Lenovo Desktop products that may allow a local attacker…
-
Medium 6.7
A buffer overflow was reported in the SmuV11DxeVMR module in some Lenovo Desktop products that may allow a local attack…
-
Medium 6.7
A buffer overflow was reported in the SmuV11Dxe driver in some Lenovo Desktop products that may allow a local attacker …
-
Medium 6.7
A buffer overflow was reported in the SmiFlash module in some Lenovo Desktop products that may allow a local attacker w…
-
Medium 6.7
A buffer overflow was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local…
-
Medium 6.7
A potential vulnerability was reported in the SMI callback function of the OemSmi driver that may allow a local attacke…
-
Medium 6.7
A buffer overflow was reported in the OemSmi module in some Lenovo Desktop products that may allow a local attacker wit…
-
Medium 4.4
A buffer over-read was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a lo…
-
Medium 6.7
A buffer overflow was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a loc…
-
High 7.5
Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloa…
-
Medium 6.7
A vulnerability was reported in some ThinkPad BIOS that could allow a physical or local attacker with elevated privileg…
-
Medium 6.7
A buffer overflow was reported in the FmpSipoCapsuleDriver driver in the IdeaPad Duet 3-10IGL5 that may allow a local a…
-
Medium 5.5
A potential use-after-free vulnerability was reported in the Lenovo View driver that could result in denial of service.
-
High 7.3
A privilege escalation vulnerability was reported in Lenovo preloaded devices deployed using Microsoft AutoPilot under …
-
High 7.8
An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local …
-
High 7.3
DLL Search Order Hijacking vulnerability in BleachBit for Windows
BleachBit cleans files to free disk space and to maintain privacy. BleachBit for Windows up to version 4.4.2 is vulnerable to a DLL Hijacking vulnerability. By placing a DLL in the Folder c:\DLLs, an attacker can run arbitrary code on every execution of Bleac…
-
Medium 4.3
Ethyca Fides HTML Injection Vulnerability in HTML-Formatted DSR Packages
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in your runtime environment, and the enforcement of privacy regulations in your code. The Fides web application allows data subject users to request acc…
-
High 7.3
ZITADEL race condition in lockout policy execution
ZITADEL provides identity infrastructure. ZITADEL provides administrators the possibility to define a `Lockout Policy` with a maximum amount of failed password check attempts. On every failed password check, the amount of failed checks is compared against the…
-
Medium 5.5
PrestaShop blockreassurance BO User can remove any file from server when adding a and deleting a block
PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworthy. When adding a block in blockreassurance module, a BO user can modify the http request and give the path of any fil…
-
Low 3.9
The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execu…
-
Medium 5.0
TIBCO Spotfire Insufficiently Protected Credential vulnerability
The Spotfire Connectors component of TIBCO Software Inc.'s Spotfire Analyst, Spotfire Server, and Spotfire for AWS Marketplace contains an easily exploitable vulnerability that allows a low privileged attacker with read/write access to craft malicious Analyst…
-
Unscored —
Use after free in WebAudio in Google Chrome prior to 119.0.6045.123 allowed a remote attacker to potentially exploit he…
-
Low —
slsa-verifier vulnerable to mproper validation of npm's publish attestations
### Summary `slsa-verifier<=2.4.0` does not correctly verify npm's [publish](https://github.com/npm/attestation/tree/main/specs/publish/v0.1) attestations signature. ### Proof of concept Steps to reproduce: 1. `curl -Sso attestations.json $(npm view @trishank…