Archive
January 2024
Vulnerabilities first published in this month (UTC), newest first.
1,235 results · Clear filters · Feed
-
Medium 6.5
Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates list
The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management, segmentation, personalization and marketing automation. An authenticated and unauthorized user can access the list of potential duplicate users and see their …
-
Medium 4.3
Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list
ecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. An authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned. Access control and permissions are not being enforced. This…
-
Medium 5.3
The remote keyless system of the Hozard alarm system (alarmsystemen) v1.0 sends an identical radio frequency signal for…
-
Medium 5.9
A default engineer password set on the Hozard alarm system (Alarmsysteem) v1.0 allows an attacker to bring the alarm sy…
-
Medium 6.5
Missing encryption in the RFID tags of the Hozard alarm system (Alarmsysteem) v1.0 allow attackers to create a cloned t…
-
Medium 6.5
Missing encryption in the NFC tags of the Flient Smart Door Lock v1.0 allows attackers to create a cloned tag via brief…
-
Medium 5.9
Hozard alarm system (Alarmsysteem) v1.0 is vulnerable to Improper Authentication. Commands sent via the SMS functionali…
-
Medium 6.8
Flient Smart Door Lock v1.0 is vulnerable to Use of Default Credentials. Due to default credentials on a debug interfac…
-
Medium 6.1
member/index/register.html in YzmCMS 6.5 through 7.0 allows XSS via the Referer HTTP header.
-
Medium 5.5
SWFTools 0.9.2 772e55a allows attackers to trigger a large memory-allocation attempt via a crafted document, as demonst…
-
Medium 6.1
Cross Site Scripting Vulnerability in Elite CRM v1.2.11 allows attacker to execute arbitrary code via the language para…
-
Medium 5.5CVE-2023-42829 Public exploit
The issue was addressed with additional restrictions on the observability of app states. This issue is fixed in macOS B…
-
Medium 5.5
This issue was addressed by improving Face ID anti-spoofing models. This issue is fixed in iOS 17 and iPadOS 17. A 3D m…
-
Medium 5.5
An issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14, iOS 16.7 and …
-
Medium 5.5
A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13. An app may be able…
-
Medium 5.5
The issue was addressed with additional permissions checks. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 1…
-
Medium 4.7
The issue was addressed with improved UI handling. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1.…
-
Medium 5.5
An integer overflow was addressed through improved input validation. This issue is fixed in tvOS 16.4, macOS Big Sur 11…
-
Medium 6.5
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3, tvOS 16.…
-
Medium 5.5
A logic issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. …
-
Medium 6.5
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3, tvOS 16.…
-
Medium 5.5
The issue was addressed with improved handling of caches. This issue is fixed in macOS Ventura 13. An app may be able t…
-
Medium 5.5
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.4 and iPadOS 16.4, watchOS 9.4. An…
-
Medium 6.5
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14, Safari 17, iOS 17 and…
-
Medium 5.5
A logic issue was addressed with improved checks This issue is fixed in macOS Sonoma 14. A camera extension may be able…
-
Medium 5.5
A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3. An app may bypass Gatekeep…
-
Medium 5.5
This issue was addressed with improved data protection. This issue is fixed in macOS Ventura 13. An app with root privi…
-
Medium 5.5
A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access …
-
Medium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access prot…
-
Medium 5.5
This issue was addressed with improved data protection. This issue is fixed in macOS Sonoma 14. An app may be able to a…
-
Medium 5.5
This issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access sen…
-
Medium 5.5
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Ventura 13. An app may be…
-
Medium 5.5
The issue was addressed with improved handling of caches. This issue is fixed in macOS Sonoma 14. An app may be able to…
-
Medium 5.5
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Big Sur 11.7.9, iOS 15.7.8 and i…
-
Medium 4.2
An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14, …
-
Medium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.6 and…
-
Medium 6.4
quic-go's path validation mechanism can cause denial of service
quic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, RFC 9002) in Go. An attacker can cause its peer to run out of memory sending a large number of PATH_CHALLENGE frames. The receiver is supposed to respond to each PATH_CHALLENGE frame with …
-
Medium 5.3
Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.216 allowed an attacker in a privileged…
-
Medium 4.8
The issue was addressed with improved checks. This issue is fixed in iOS 17.2 and iPadOS 17.2. An attacker in a privile…
-
Medium 5.5
Executable files writable by low-privileged users in Omron Sysmac Studio
Sysmac Studio installs executables in a directory with poor permissions. This can allow a locally-authenticated attacker to overwrite files which will result in code execution with privileges of a different user.