106,755 results · Clear filters · Feed
-
Medium 6.0
On affected platforms running Arista EOS in multi-agent routing model with BGP Segment Routing Traffic Engineering (SR-…
-
Medium 6.0
On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the …
-
Medium 6.1
On affected EOS platforms where 802.1x is configured in multi-host authenticated mode and the device is configured with…
-
Medium 6.1
This vulnerability affects customers using Arista Pathfinder for WAN path selection with Border Gateway Protocol-Link S…
-
Medium 6.0
On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the …
-
Medium 6.0
On affected Arista EOS platforms running Border Gateway Protocol with Link State ( BGP-LS) and configured with the Dyna…
-
Medium 6.9
On affected platforms running Arista EOS with IPsec AutoVPN Feature configured with dynamic paths, the configured IPsec…
-
Medium 4.3
Winter: My Account preview exposes another backend user's profile by record ID
Winter CMS is a content management system built on the Laravel PHP framework. From 1.2.13 until 1.2.14, the Backend\Controllers\MyAccount controller inherits the FormController actions create, update, and preview while declaring an empty $requiredPermissions …
-
Medium 6.1
A use-after-free read issue exists in MongoDB’s SBE (Slot-Based Execution) engine when processing aggregation pipelines…
-
Medium 4.5
Winter: Reflected XSS through the search query parameter in the backend Table widget
Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.420 until 1.2.14, the backend Table widget partial modules/backend/widgets/table/partials/_table.php emits the search query parameter without HTML encoding inside a script …
-
Medium 6.5
A vulnerability exists in a system interface that may, under certain conditions, fail to properly enforce authorization…
-
Medium 6.1
Winter: CSRF through AJAX handler names reachable as backend page actions
Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.319 until 1.2.14, Backend\Classes\Controller::actionExists() accepts public handler-shaped methods as page actions, so a top-level GET request can invoke state-changing bac…
-
Medium 6.8
Incorrect default file permissions in Kiro CLI (formerly Amazon Q Developer CLI) before version 2.27.0 on macOS and Lin…
-
Medium 4.5
Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles
Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, BrandSetting::renderCss() and EditorSetting::renderCss() store raw LESS compiler output with Cache::forever() but apply strip_tags() only to the value returned on a…
-
Medium 6.5
Worklenz < 3.3.0 SQL Injection via Reporting Members Endpoint
Worklenz before 3.3.0 contains an SQL injection vulnerability in the reporting members endpoints that allows authenticated attackers to read arbitrary database contents by injecting SQL through the projects and status parameters. Attackers can send crafted va…
-
Medium 4.4
Out-Of-Bounds Read in the MSI-X table in the QVM could allow an attacker in the guest to cause an information disclosur…
-
Medium 6.7
In multiple locations, there is a possible way to modify coprocessor instruction and data memory from non-secure softwa…
-
Medium 5.3
postal-mime < 4.2.1 Algorithmic Complexity DoS via processLine
postal-mime before 4.2.1 contains an algorithmic complexity denial of service vulnerability that allows unauthenticated remote attackers to cause excessive CPU consumption in the PostalMime.processLine() function by crafting deeply nested multipart email mess…
-
Medium 6.7
In smmu_domain_config_s1 of arm-smmu-v3.c, there is a possible OOB Write due to a missing bounds check. This could lead…
-
Medium 6.7
In update_user_consent of main.rs, there is a possible elevation of privilege due to uninitialized data. This could lea…
-
Medium 6.7
In HostLinkBase::chreIpiHandler of host_link.cc, there is a possible out-of-bounds write due to a missing bounds check.…
-
Medium 6.4
In multiple locations, there is a possible use-after-free due to a race condition. This could lead to local escalation …
-
Medium 6.7
In multiple files, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local esca…
-
Medium 6.7
In multiple locations, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to local …
-
Medium 6.7
In access_control_enable of multiple files, there is a possible way to release secure coprocessors from reset via uncla…
-
Medium 6.4
In multiple locations, there is a possible way to modify authenticated coprocessor firmware in shared memory before loa…
-
Medium 6.7
In handle_fips_hmac_req of hwcrypto_proxy.c, there is a possible heap buffer overflow due to missing bounds check. This…
-
Medium 6.7
In ac_set_ns_ipa_tbl of plat_trusty.c, there is a possible way to corrupt stream table entry configurations via unvalid…
-
Medium 6.7
In km_read_data_response of keymaster.c, there is a possible way to trigger an out of bounds write on the heap due to a…
-
Medium 6.4
In handle_chan_msg of tipc_virtio_dev.c, there is a possible way to bypass memory tag access controls via concurrent sh…
-
Medium 4.0
Improper Input Validation in a procnto message handler could allow an attacker with local access to send a crafted mess…
-
Medium 4.0
Invalid Pointer Reference in the TimerSettime() system call could allow an attacker with local access to arm a crafted …
-
Medium 5.9
Forge: TLS client crash on a handshake record received without a session
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client can pass a handshake record to tls.handleHandshake() while the connection has no session, including after a close_notify al…
-
Medium 5.9
Forge: ReDoS in forge.http response header and cookie trimming
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. From 0.1.2 until 1.4.3, forge.http uses _trimString() in lib/http.js to remove trailing whitespace from response header values and cookie names and values wit…
-
Medium 5.9
Forge: TLS client crash on an unsupported ServerHello compression method
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client accepts a ServerHello compression_method that it did not offer. When the client later handles ServerHelloDone, tls.createCo…
-
Medium 6.3
imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLS
IMAP4.starttls() wraps the socket in TLS but leaves self._readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv() as the tagged OK to STARTTLS are returned by readline() after the handshake, so the client treat…
-
Medium 5.6
Leak SMM RAM from the kernel (Simply TSA after an SMI)
EDK2 contains a vulnerability in BIOS where a privileged attacker may cause “Exposure of Sensitive Information during Transient Execution” by local access. Successful exploitation of this vulnerability may result in disclosure of SMRAM contents. It could also…
-
Medium 6.2
Vulnerabilities in the QNX io-char library Impacts QNX Software Development Platform
Improper Input Validation in the io-char library's DCMD_CHR_TCINJECTC devctl() handler could allow an attacker with local access to cause data tampering in the memory input buffer of the Character I/O device driver.
-
Medium 6.9
Heap-based buffer overflow for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a deni…
-
Medium 5.1
Improper initialization in the MigTD virtio-vsock stream handling for the Intel(R) TDX Migration Trust Domain (MigTD) w…