Archive
February 2024
Vulnerabilities first published in this month (UTC), newest first.
2,826 results · Feed
-
Critical 9.7CVE-2023-50257 Public exploit
Disconnect Vulnerability in RTPS Packets Used by SROS2
eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Even with the application of SROS2, due to the issue where the data (`p[UD]`) and `guid` values used to disconnect between…
-
Low 2.0
FIP Header Integer Overflow
During the secure boot, bl2 (the second stage of the bootloader) loops over images defined in the table “bl2_mem_params_descs”. For each image, the bl2 reads the image length and destination from the image’s certificate. Because of the way of reading from the…
-
Low 3.5
Msa-24-0006: idor on dashboard comments block
Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available (e.g., on their profile page).
-
Medium 4.3
Msa-24-0005: csrf risk in language import utility
The link to update all installed language packs did not include the necessary token to prevent a CSRF risk.
-
Medium 4.3
Msa-24-0004: forum export did not respect activity group settings
Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default this only provided additional access to non-editing teachers.
-
Medium 4.3
Msa-24-0003: h5p attempts report did not respect activity group settings
Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.
-
Medium 5.3
Msa-24-0002: forum search accepted random parameters in its url
The URL parameters accepted by forum search were not limited to the allowed parameters.
-
High 7.5
Msa-24-0001: denial of service risk in file picker unzip functionality
Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality.
-
High 8.1
Pimcore Host Header Injection in user invitation link
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. A potential security vulnerability has been discovered in `pimcore/admin-ui-classic-bundle` prior to version 1.3.4. The vulnerability involves a Host Header Injection in the `invitationLinkActi…
-
High 8.5
Lack of media type verification of Activity Streams objects allows impersonation of remote accounts
Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19, when fetching remote statuses, Mastodon doesn't check that the response from the remote server has a `Content-Type` header value o…
-
Critical 10.0
pgjdbc SQL Injection via line comment generation
pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There mu…
-
Medium 6.8CVE-2024-1346 Public exploit
Weak MySQL database root password in LaborOfficeFree
Weak MySQL database root password in LaborOfficeFree affects version 19.10. This vulnerability allows an attacker to calculate the root password of the MySQL database used by LaborOfficeFree using two constants.
-
Medium 6.8
Weak MySQL database root password in LaborOfficeFree
Weak MySQL database root password in LaborOfficeFree affects version 19.10. This vulnerability allows an attacker to perform a brute force attack and easily discover the root password.
-
Medium 6.8
Encrypted database credentials in LaborOfficeFree
Encrypted database credentials in LaborOfficeFree affecting version 19.10. This vulnerability allows an attacker to read and extract the username and password from the database of 'LOF_service.exe' and 'LaborOfficeFree.exe' located in the '%programfiles(x86)%…
-
Medium 4.7
Weak permission vulnerability in LaborOfficeFree
A weak permission was found in the backup directory in LaborOfficeFree affecting version 19.10. This vulnerability allows any authenticated user to read backup files in the directory '%programfiles(x86)% LaborOfficeFree BackUp'.
-
Medium 5.9
Integer overflow in VideoLAN dav1d
An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.
-
High 8.1
Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue.
-
Medium 5.5CVE-2024-26308 Public exploit
Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file
Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue.
-
Medium 5.5
plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for Gla…
-
High 7.5
Yealink Config Encrypt Tool add RSA before 1.2 has a built-in RSA key pair, and thus there is a risk of decryption by a…
-
High 7.8
close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE.
-
Critical 9.1
An unquoted service path vulnerability in the 12d Synergy Server and File Replication Server components may allow an at…
-
Medium 5.3
An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where…
-
Medium 6.0
An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRI…
-
Medium 6.1
Cross-site Scripting in Serenity
Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character.
-
Medium 4.4
can: out of bounds in remove_rx_filter function
can: out of bounds in remove_rx_filter function
-
High 8.0
ipm: signed to unsigned conversion problem in esp32_ipm_send
Signed to unsigned conversion esp32_ipm_send
-
High 8.0
Unchecked user input length in the Zephyr Settings Shell
Unchecked length coming from user input in settings shell
-
Medium 6.3
Vulnerability of missing authentication for critical functions in the Wi-Fi module.Successful exploitation of this vuln…
-
Critical 9.8
Script injection vulnerability in the email module.Successful exploitation of this vulnerability may affect service con…
-
Medium 4.3
Vulnerability of improper access control in the email module.Successful exploitation of this vulnerability may affect s…
-
High 7.5
Permission control vulnerability in the calendarProvider module.Successful exploitation of this vulnerability may affec…
-
Critical 9.8
Vulnerability of incorrect service logic in the WindowManagerServices module.Successful exploitation of this vulnerabil…
-
High 7.4
Vulnerability of input data not being verified in the cellular data module.Successful exploitation of this vulnerabilit…
-
High 7.5
Information management vulnerability in the Gallery module.Successful exploitation of this vulnerability may affect ser…
-
Medium 5.5
Permission control vulnerability in the WindowManagerServices module.Successful exploitation of this vulnerability may …
-
High 7.5
Permission control vulnerability in the package management module.Successful exploitation of this vulnerability may aff…
-
High 7.5
Vulnerability of permission verification in the content sharing pop-up module.Successful exploitation of this vulnerabi…
-
High 7.5
Vulnerability of input parameter verification in the motor module.Successful exploitation of this vulnerability may aff…
-
Low 3.5
Vulnerability of null references in the motor module.Successful exploitation of this vulnerability may affect availabil…