Archive
12 February 2025
Vulnerabilities first published on this day (UTC), newest first.
265 results · Feed
-
High 7.5
Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enab…
-
High 8.2
Improper input validation in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enab…
-
Low 2.3
Improper initialization in the firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow a privilege…
-
Medium 6.0
Improper access control in some Intel(R) ME driver pack installer engines before version 2422.6.2.0 may allow an authen…
-
High 7.7
Improper input validation in the firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow an authen…
-
Medium 5.3
Improper buffer restrictions in the UEFI firmware for some Intel(R) Processors may allow a privileged user to potential…
-
High 7.5
Improper buffer restrictions in the UEFI firmware for some Intel(R) Processors may allow a privileged user to potential…
-
Medium 4.5
Stack-based buffer overflow in some drivers for Intel(R) Ethernet Connection I219 Series before version 12.19.1.39 may …
-
Medium 6.5
Improper access control in some drivers for Intel(R) Ethernet Connection I219 Series before version 12.19.1.39 may allo…
-
Medium 6.5
Out-of-bounds write in the Intel(R) 800 Series Ethernet Driver for Intel(R) Ethernet Adapter Complete Driver Pack befor…
-
Medium 6.7
Uncontrolled search path in some Intel(R) Ethernet Adapter Complete Driver Pack install before versions 29.1 may allow …
-
Medium 6.7
Uncontrolled search path for some Intel(R) Chipset Software Installation Utility before version 10.1.19867.8574 may all…
-
Medium 6.7
Uncontrolled search path for some Intel(R) MPI Library for Windows software before version 2021.13 may allow an authent…
-
Medium 6.7
Uncontrolled search path for some Intel(R) Advisor software before version 2024.2 may allow an authenticated user to po…
-
Medium 6.7
Uncontrolled search path for some EPCT software before version 1.42.8.0 may allow an authenticated user to potentially …
-
High 7.5
Time-of-check time-of-use race condition for some Intel(R) Battery Life Diagnostic Tool software before version 2.4.1 m…
-
Low 3.3
Incorrect execution-assigned permissions in the Linux kernel mode driver for the Intel(R) 800 Series Ethernet Driver be…
-
Medium 6.7
Uncontrolled search path element in some BIOS and System Firmware Update Package for Intel(R) Server M50FCP family befo…
-
Medium 6.7
Uncontrolled search path in some Intel(R) VPL software before version 2023.4.0 may allow an authenticated user to poten…
-
Medium 5.9
Improper access control in some Intel(R) GPA software before version 2024.3 may allow an authenticated user to potentia…
-
Medium 6.7
Incorrect default permissions for some Intel(R) GPA and Intel(R) GPA Framework software installers may allow an authent…
-
Medium 6.5
Improper input validation in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable denia…
-
High 8.2
Improper access control in some Intel(R) Graphics Driver software installers may allow an authenticated user to potenti…
-
High 8.8
Improper access control in some Intel(R) Graphics software may allow an authenticated user to potentially enable escala…
-
Medium 5.0
Improper input validation for some Intel(R) QuickAssist Technology software before version 2.2.0 may allow an authentic…
-
Medium 6.1
Untrusted Pointer Dereference in I/O subsystem for some Intel(R) QAT software before version 2.0.5 may allow authentica…
-
Medium 6.7
Uncontrolled search path for some Intel(R) QuickAssist Technology software before version 2.2.0 may allow an authentica…
-
High 7.8
Out-of-bounds write for some Intel(R) QuickAssist Technology software before version 2.2.0 may allow an authenticated u…
-
Critical —
Crayfish Allows Remote Code Execution via hypercube X-Islandora-Args Header
### Impact _What kind of vulnerability is it? Who is impacted?_ Remote code execution is possible in web-accessible installations of hypercube. ### Patches _Has the problem been patched? What versions should users upgrade to?_ Not yet, though no patch is necc…
-
Medium 5.3
Cortex XDR Broker VM: Unauthorized Access to Broker VM Docker Containers
A problem with the network isolation mechanism of the Palo Alto Networks Cortex XDR Broker VM allows attackers unauthorized access to Docker containers from the host network used by Broker VM. This may allow access to read files sent for analysis and logs tra…
-
High 7.5
PAN-OS OpenConfig Plugin: Command Injection Vulnerability in OpenConfig Plugin
A command injection vulnerability in the Palo Alto Networks PAN-OS OpenConfig plugin enables an authenticated administrator with the ability to make gNMI requests to the PAN-OS management web interface to bypass system restrictions and run arbitrary commands.…
-
Medium 6.3
ywoa AddressDao.xml selectList sql injection
A vulnerability was found in ywoa up to 2024.07.03. It has been rated as critical. This issue affects the function selectList of the file com/cloudweb/oa/mapper/xml/AddressDao.xml. The manipulation leads to sql injection. The attack may be initiated remotely.…
-
Medium 5.9CVE-2025-0111 Exploited
PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface
An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can gre…
KEV Feb 20, 2025 -
Low 2.1
PAN-OS: Unauthenticated File Deletion Vulnerability on the Management Web Interface
An unauthenticated file deletion vulnerability in the Palo Alto Networks PAN-OS management web interface enables an unauthenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limite…
-
Medium 5.9
PAN-OS: Authentication Bypass in the Management Web Interface
An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certai…
KEV Feb 18, 2025 -
High 7.8
An improper privilege vulnerability was reported in a BIOS customization feature of Lenovo Vantage on SMB notebook devi…
-
Medium 5.3
ywoa setup.jsp improper authorization
A vulnerability was found in ywoa up to 2024.07.03. It has been declared as critical. This vulnerability affects unknown code of the file /oa/setup/setup.jsp. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit …
-
Medium 6.3
ywoa WXCallBack Interface XMLParse.java extract xml external entity reference
A vulnerability, which was classified as problematic, has been found in ywoa up to 2024.07.03. This issue affects the function extract of the file c-main/src/main/java/com/redmoon/weixin/aes/XMLParse.java of the component WXCallBack Interface. The manipulatio…
-
Critical —
Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)
### Summary Private key can be extracted from ECDSA signature upon signing a malformed input (e.g. a string or a number), which could e.g. come from JSON network input Note that `elliptic` by design accepts hex strings as one of the possible input types ### D…
-
Medium 6.3
ywoa UserMapper.xml listNameBySql sql injection
A vulnerability classified as critical was found in ywoa up to 2024.07.03. This vulnerability affects the function listNameBySql of the file com/cloudweb/oa/mapper/xml/UserMapper.xml. The manipulation leads to sql injection. The attack can be initiated remote…