Archive
28 January 2025
Vulnerabilities first published on this day (UTC), newest first.
102 results · Feed
-
Medium 5.5
NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could l…
-
High 7.6
NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could l…
-
High 7.6
NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could l…
-
Medium 4.0
IBM Fusion improper communication restriction
IBM Fusion and IBM Fusion HCI 2.3.0 through 2.8.2 is vulnerable to insecure network connection by allowing an attacker who gains access to a Fusion container to establish an external network connection.
-
High 7.5
ParsePKCS1PrivateKey panic with partial keys in crypto/x509
Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed.
-
Medium 6.1
Sensitive headers incorrectly sent after cross-domain redirect in net/http
The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subs…
-
Medium 6.1
Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509
A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs whi…
-
High 7.1
Vulnerability when creating log files in github.com/golang/glog
When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow th…
-
High 8.8
GOAUTH credential leak in cmd/go
Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not have access to. By default, unless otherwise set, this only affected credentials stored in the user…
-
Critical 9.8
Buffer overflow in XPS data font processing of Small Office Multifunction Printers and Laser Printers(*) which may allo…
-
Critical 9.8
Buffer overflow in TIFF data EXIF tag processing of Small Office Multifunction Printers and Laser Printers(*) which may…
-
Critical 9.8
Buffer overflow in CPCA font download processing of Small Office Multifunction Printers and Laser Printers(*) which may…
-
Medium 6.3
IBM Sterling B2B Integrator information disclosure
IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the bac…
-
Critical 9.8CVE-2022-3365 Public exploit
Emote Interactive Remote Mouse Server command injection due to weak encoding
Due to reliance on a trivial substitution cipher, sent in cleartext, and the reliance on a default password when the user does not set a password, the Remote Mouse Server by Emote Interactive can be abused by attackers to inject OS commands over theproduct's …
-
Medium 5.3
IBM Sterling B2B Integrator information disclosure
IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 could allow an authenticated user to obtain sensitive information from the dashboard UI using man in the middle techniques.
-
High 8.8CVE-2024-55968 Public exploit
An issue was discovered in DTEX DEC-M (DTEX Forwarder) 6.1.1. The com.dtexsystems.helper service, responsible for handl…
-
High 7.5
AutoLib Software Systems OPAC v20.10 was discovered to have multiple API keys exposed within the source code. Attackers…
-
High 8.8CVE-2024-57376 Public exploit
Buffer Overflow vulnerability in D-Link DSR-150, DSR-150N, DSR-250, DSR-250N, DSR-500N, DSR-1000N from 3.13 to 3.17B901…
-
Medium 4.8
The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting (XSS) due to improper handling of directory list…
-
High 7.5
An issue in Open5GS v.2.7.2 allows a remote attacker to cause a denial of service via the ogs_dbi_auth_info function in…
-
High 7.1
Mailcow through 2024-11b has a session fixation vulnerability in the web panel. It allows remote attackers to set a ses…
-
Medium 5.4
A reflected cross-site scripting (XSS) vulnerability in Audemium ERP <=0.9.0 allows remote attackers to execute an arbi…