Thu, May 03 · 10:55 PM CDTCVE-2012-1710
9.8/10 · Must read/watchNVDvuln
Summary
Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Designer, a different vulnerability than CVE-2012-1709.
CVECVE-2012-1710
SeverityCRITICAL
TypeUPDATED
PublishedThu, May 03 · 10:55 PM CDT
ModifiedTue, Aug 04 · 05:16 AM CDT
CVE-2012-1723
9.8/10 · Must read/watchNVDvuln
Summary
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
CVECVE-2012-1723
SeverityCRITICAL
TypeUPDATED
PublishedSat, Jun 16 · 09:55 PM CDT
ModifiedTue, Aug 04 · 05:16 AM CDT
CVE-2012-4681
9.8/10 · Must read/watchNVDvuln
Summary
Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the
CVECVE-2012-4681
SeverityCRITICAL
TypeUPDATED
PublishedTue, Aug 28 · 12:55 AM CDT
ModifiedTue, Aug 04 · 05:16 AM CDT
CVE-2019-15107
9.8/10 · Must read/watchNVDvuln
Summary
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.
CVECVE-2019-15107
SeverityCRITICAL
TypeUPDATED
PublishedFri, Aug 16 · 03:15 AM CDT
ModifiedTue, Aug 04 · 05:16 AM CDT
CVE-2021-44529
9.8/10 · Must read/watchNVDvuln
Summary
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).
CVECVE-2021-44529
SeverityCRITICAL
TypeUPDATED
PublishedWed, Dec 08 · 10:15 PM CST
ModifiedTue, Aug 04 · 05:16 AM CDT
CVE-2021-46911
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ch_ktls: Fix kernel panic Taking page refcount is not ideal and causes kernel panic sometimes. It's better to take tx_ctx lock for the complete skb transmit, to avoid page cleanup if ACK received in middle.
CVECVE-2021-46911
SeverityCRITICAL
TypeUPDATED
PublishedTue, Feb 27 · 07:15 AM CST
ModifiedTue, Aug 04 · 10:16 AM CDT
CVE-2021-46999
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: sctp: do asoc update earlier in sctp_sf_do_dupcook_a There's a panic that occurs in a few of envs, the call trace is as below: [] general protection fault, ... 0x29acd70f1000a: 0000 [#1] SMP PTI [] RIP: 0010:sctp_ulpevent_notify_peer_addr_change+0x4b/0
CVECVE-2021-46999
SeverityCRITICAL
TypeUPDATED
PublishedWed, Feb 28 · 09:15 AM CST
ModifiedTue, Aug 04 · 10:16 AM CDT
CVE-2021-47013
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send In emac_mac_tx_buf_send, it calls emac_tx_fill_tpd(..,skb,..). If some error happens in emac_tx_fill_tpd(), the skb will be freed via dev_kfree_skb(skb) in error branch of emac_tx_fill_tpd
CVECVE-2021-47013
SeverityCRITICAL
TypeUPDATED
PublishedWed, Feb 28 · 09:15 AM CST
ModifiedTue, Aug 04 · 10:16 AM CDT
CVE-2021-47036
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: udp: skip L4 aggregation for UDP tunnel packets If NETIF_F_GRO_FRAGLIST or NETIF_F_GRO_UDP_FWD are enabled, and there are UDP tunnels available in the system, udp_gro_receive() could end-up doing L4 aggregation (either SKB_GSO_UDP_L4 or SKB_GSO_FRAGLIS
CVECVE-2021-47036
SeverityCRITICAL
TypeUPDATED
PublishedWed, Feb 28 · 09:15 AM CST
ModifiedTue, Aug 04 · 10:16 AM CDT
CVE-2021-47103
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: inet: fully convert sk->sk_rx_dst to RCU rules syzbot reported various issues around early demux, one being included in this changelog [1] sk->sk_rx_dst is using RCU protection without clearly documenting it. And following sequences in tcp_v4_do_rcv()/
CVECVE-2021-47103
SeverityCRITICAL
TypeUPDATED
PublishedMon, Mar 04 · 06:15 PM CST
ModifiedTue, Aug 04 · 10:16 AM CDT
CVE-2021-47107
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix READDIR buffer overflow If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results in an underflow, allowing the XDR stream functions to write be
CVECVE-2021-47107
SeverityCRITICAL
TypeUPDATED
PublishedMon, Mar 04 · 07:15 PM CST
ModifiedTue, Aug 04 · 10:16 AM CDT
CVE-2022-37042
9.8/10 · Must read/watchNVDvuln
Summary
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this iss
CVECVE-2022-37042
SeverityCRITICAL
TypeUPDATED
PublishedFri, Aug 12 · 03:15 PM CDT
ModifiedTue, Aug 04 · 05:16 AM CDT
CVE-2023-52440
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob() If authblob->SessionKey.Length is bigger than session key size(CIFS_KEY_SIZE), slub overflow can happen in key exchange codes. cifs_arc4_crypt copy to session key array from SessionKey from c
CVECVE-2023-52440
SeverityCRITICAL
TypeUPDATED
PublishedWed, Feb 21 · 08:15 AM CST
ModifiedTue, Aug 04 · 10:18 AM CDT
CVE-2023-52480
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix race condition between session lookup and expire Thread A + Thread B ksmbd_session_lookup | smb2_sess_setup sess = xa_load | | | xa_erase(&conn->sessions, sess->id); | | ksmbd_session_destroy(sess) --> kfree(sess) | // UAF! | sess->last_acti
CVECVE-2023-52480
SeverityCRITICAL
TypeUPDATED
PublishedThu, Feb 29 · 06:15 AM CST
ModifiedTue, Aug 04 · 10:18 AM CDT
CVE-2023-52515
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: Do not call scsi_done() from srp_abort() After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler callback, it performs one of the following actions: * Call scsi_queue_insert(). * Call scsi_finish_command(). * Call scsi_eh_scmd_
CVECVE-2023-52515
SeverityCRITICAL
TypeUPDATED
PublishedSat, Mar 02 · 10:15 PM CST
ModifiedTue, Aug 04 · 10:18 AM CDT
CVE-2024-21762
9.8/10 · Must read/watchNVDvuln
Summary
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 throu
CVECVE-2024-21762
SeverityCRITICAL
TypeUPDATED
PublishedFri, Feb 09 · 09:15 AM CST
ModifiedTue, Aug 04 · 05:16 AM CDT
CVE-2019-25160
9.1/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: netlabel: fix out-of-bounds memory accesses There are two array out-of-bounds memory accesses, one in cipso_v4_map_lvl_valid(), the other in netlbl_bitmap_walk(). Both errors are embarassingly simple, and the fixes are straightforward. As a FYI for any
CVECVE-2019-25160
SeverityCRITICAL
TypeUPDATED
PublishedMon, Feb 26 · 06:15 PM CST
ModifiedTue, Aug 04 · 10:16 AM CDT
CVE-2023-52441
9.1/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds in init_smb2_rsp_hdr() If client send smb2 negotiate request and then send smb1 negotiate request, init_smb2_rsp_hdr is called for smb1 negotiate request since need_neg is set to false. This patch ignore smb1 packets after ->ne
CVECVE-2023-52441
SeverityCRITICAL
TypeUPDATED
PublishedWed, Feb 21 · 08:15 AM CST
ModifiedTue, Aug 04 · 10:18 AM CDT
CVE-2023-52442
9.1/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in compound request `smb2_get_msg()` in smb2_get_ksmbd_tcon() and smb2_check_user_session() will always return the first request smb2 header in a compound request. if `SMB2_TREE_CONNECT_HE` is the first command in
CVECVE-2023-52442
SeverityCRITICAL
TypeUPDATED
PublishedWed, Feb 21 · 08:15 AM CST
ModifiedTue, Aug 04 · 10:18 AM CDT
CVE-2024-21887
9.1/10 · Must read/watchNVDvuln
Summary
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
CVECVE-2024-21887
SeverityCRITICAL
TypeUPDATED
PublishedFri, Jan 12 · 05:15 PM CST
ModifiedTue, Aug 04 · 05:16 AM CDT
CVE-2017-6884
8.8/10 · Worth your timeNVDvuln
Summary
A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute arbitrary commands on the router, such as the ping_ip parame
CVECVE-2017-6884
SeverityHIGH
TypeUPDATED
PublishedThu, Apr 06 · 05:59 PM CDT
ModifiedTue, Aug 04 · 05:16 AM CDT
CVE-2021-47017
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ath10k: Fix a use after free in ath10k_htc_send_bundle In ath10k_htc_send_bundle, the bundle_skb could be freed by dev_kfree_skb_any(bundle_skb). But the bundle_skb is used later by bundle_skb->len. As skb_len = bundle_skb->len, my patch replaces bundl
CVECVE-2021-47017
SeverityHIGH
TypeUPDATED
PublishedWed, Feb 28 · 09:15 AM CST
ModifiedTue, Aug 04 · 10:16 AM CDT
CVE-2021-47035
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Remove WO permissions on second-level paging entries When the first level page table is used for IOVA translation, it only supports Read-Only and Read-Write permissions. The Write-Only permission is not supported as the PRESENT bit (implyin
CVECVE-2021-47035
SeverityHIGH
TypeUPDATED
PublishedWed, Feb 28 · 09:15 AM CST
ModifiedTue, Aug 04 · 10:16 AM CDT
CVE-2022-2294
8.8/10 · Worth your timeNVDvuln
Summary
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVECVE-2022-2294
SeverityHIGH
TypeUPDATED
PublishedThu, Jul 28 · 02:15 AM CDT
ModifiedTue, Aug 04 · 05:16 AM CDT
CVE-2023-52478
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect hidpp_connect_event() has *four* time-of-check vs time-of-use (TOCTOU) races when it races with itself. hidpp_connect_event() primarily runs from a workqueue but it also runs on probe() a
CVECVE-2023-52478
SeverityHIGH
TypeUPDATED
PublishedThu, Feb 29 · 06:15 AM CST
ModifiedTue, Aug 04 · 10:18 AM CDT
