Total
210374 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-1919 | 1 Google | 1 Chrome | 2022-12-09 | N/A | 8.8 HIGH |
| Use after free in Codecs in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | |||||
| CVE-2022-25763 | 3 Apache, Debian, Fedoraproject | 3 Traffic Server, Debian Linux, Fedora | 2022-12-09 | N/A | 7.5 HIGH |
| Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle or cache poison attacks. This issue affects Apache Traffic Server 8.0.0 to 9.1.2. | |||||
| CVE-2022-35414 | 2 Debian, Qemu | 2 Debian Linux, Qemu | 2022-12-09 | 6.1 MEDIUM | 8.8 HIGH |
| ** DISPUTED ** softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use case are not considered security bugs at this time." | |||||
| CVE-2021-22959 | 3 Debian, Llhttp, Oracle | 3 Debian Linux, Llhttp, Graalvm | 2022-12-09 | 6.4 MEDIUM | 6.5 MEDIUM |
| The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6. | |||||
| CVE-2019-4087 | 1 Ibm | 1 Spectrum Protect Operations Center | 2022-12-09 | 10.0 HIGH | 9.8 CRITICAL |
| IBM Spectrum Protect Servers 7.1 and 8.1 and Storage Agents are vulnerable to a stack-based buffer overflow, caused by improper bounds checking by servers and storage agents in response to specifically crafted communication exchanges. By sending an overly long request, a remote attacker could overflow a buffer and execute arbitrary code on the system with instance id privileges or cause the server or storage agent to crash. IBM X-Force ID: 157510. | |||||
| CVE-2019-4057 | 3 Ibm, Linux, Microsoft | 3 Db2, Linux Kernel, Windows | 2022-12-09 | 7.2 HIGH | 6.7 MEDIUM |
| IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow malicious user with access to the DB2 instance account to leverage a fenced execution process to execute arbitrary code as root. IBM X-Force ID: 156567. | |||||
| CVE-2006-3240 | 1 Dotproject | 1 Dotproject | 2022-12-09 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in classes/ui.class.php in dotProject 2.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the login parameter. | |||||
| CVE-2022-31101 | 1 Prestashop | 1 Blockwishlist | 2022-12-09 | 6.5 MEDIUM | 8.8 HIGH |
| prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue. | |||||
| CVE-2021-44227 | 2 Debian, Gnu | 2 Debian Linux, Mailman | 2022-12-09 | 6.8 MEDIUM | 8.8 HIGH |
| In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes. | |||||
| CVE-2022-32275 | 1 Grafana | 1 Grafana | 2022-12-09 | 5.0 MEDIUM | 7.5 HIGH |
| ** DISPUTED ** Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd URI. NOTE: the vendor's position is that there is no vulnerability; this request yields a benign error page, not /etc/passwd content. | |||||
| CVE-2021-43332 | 2 Debian, Gnu | 2 Debian Linux, Mailman | 2022-12-09 | 4.0 MEDIUM | 6.5 MEDIUM |
| In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack. | |||||
| CVE-2021-43331 | 2 Debian, Gnu | 2 Debian Linux, Mailman | 2022-12-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS. | |||||
| CVE-2017-8844 | 2 Debian, Long Range Zip Project | 2 Debian Linux, Long Range Zip | 2022-12-09 | 6.8 MEDIUM | 7.8 HIGH |
| The read_1g function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted archive. | |||||
| CVE-2022-45499 | 1 Tenda | 2 W6-s, W6-s Firmware | 2022-12-09 | N/A | 7.5 HIGH |
| Tenda W6-S v1.0.0.4(510) was discovered to contain a stack overflow via the wl_radio parameter at /goform/WifiMacFilterGet. | |||||
| CVE-2017-8845 | 1 Long Range Zip Project | 1 Long Range Zip | 2022-12-09 | 4.3 MEDIUM | 5.5 MEDIUM |
| The lzo1x_decompress function in lzo1x_d.ch in LZO 2.08, as used in lrzip 0.631, allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted archive. | |||||
| CVE-2020-11511 | 1 Thimpress | 1 Learnpress | 2022-12-09 | 6.8 MEDIUM | 8.1 HIGH |
| The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher action parameter. | |||||
| CVE-2021-24356 | 1 Wpdeveloper | 1 Simple 301 Redirects | 2022-12-09 | 6.5 MEDIUM | 8.8 HIGH |
| In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, a lack of capability checks and insufficient nonce check on the AJAX action, simple301redirects/admin/activate_plugin, made it possible for authenticated users to activate arbitrary plugins installed on vulnerable sites. | |||||
| CVE-2021-24355 | 1 Wpdeveloper | 1 Simple 301 Redirects | 2022-12-09 | 4.0 MEDIUM | 4.3 MEDIUM |
| In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, the lack of capability checks and insufficient nonce check on the AJAX actions, simple301redirects/admin/get_wildcard and simple301redirects/admin/wildcard, made it possible for authenticated users to retrieve and update the wildcard value for redirects. | |||||
| CVE-2017-8846 | 2 Debian, Long Range Zip Project | 2 Debian Linux, Long Range Zip | 2022-12-09 | 4.3 MEDIUM | 5.5 MEDIUM |
| The read_stream function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted archive. | |||||
| CVE-2017-8847 | 1 Long Range Zip Project | 1 Long Range Zip | 2022-12-09 | 4.3 MEDIUM | 5.5 MEDIUM |
| The bufRead::get() function in libzpaq/libzpaq.h in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted archive. | |||||