VYPR

CVEs

130,191 total · page 1745 of 2,604

AllCriticalHighKEV
  • CVE-2022-22611HigMar 18, 2022
    Apple Inc.
    macOS
    risk 0.51cvss 7.8epss 0.01

    An out-of-bounds read was addressed with improved input validation. This issue is fixed in tvOS 15.4, iOS 15.4 and iPadOS 15.4, iTunes 12.12.3 for Windows, watchOS 8.5, macOS Monterey 12.3. Processing a maliciously crafted image may lead to arbitrary code execution.

  • CVE-2022-22609HigMar 18, 2022
    Apple Inc.
    macOS
    risk 0.49cvss 7.5epss 0.01

    The issue was addressed with additional permissions checks. This issue is fixed in tvOS 15.4, iOS 15.4 and iPadOS 15.4, macOS Monterey 12.3, watchOS 8.5. A malicious application may be able to read other applications' settings.

  • CVE-2022-22608HigMar 18, 2022
    Apple Inc.
    Xcode
    risk 0.51cvss 7.8epss 0.01

    An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.

  • CVE-2022-22607HigMar 18, 2022
    Apple Inc.
    Xcode
    risk 0.51cvss 7.8epss 0.01

    An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.

  • CVE-2022-22606HigMar 18, 2022
    Apple Inc.
    Xcode
    risk 0.51cvss 7.8epss 0.01

    An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.

  • CVE-2022-22605HigMar 18, 2022
    Apple Inc.
    Xcode
    risk 0.51cvss 7.8epss 0.01

    An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.

  • CVE-2022-22604HigMar 18, 2022
    Apple Inc.
    Xcode
    risk 0.51cvss 7.8epss 0.01

    An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.

  • CVE-2022-22603HigMar 18, 2022
    Apple Inc.
    Xcode
    risk 0.51cvss 7.8epss 0.01

    An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.

  • CVE-2022-22602HigMar 18, 2022
    Apple Inc.
    Xcode
    risk 0.51cvss 7.8epss 0.01

    An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.

  • CVE-2022-22601HigMar 18, 2022
    Apple Inc.
    Xcode
    risk 0.51cvss 7.8epss 0.01

    An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.

  • CVE-2022-22597HigMar 18, 2022
    Apple Inc.
    macOS
    risk 0.51cvss 7.8epss 0.01

    A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.6.5, macOS Monterey 12.3, Security Update 2022-003 Catalina. Processing a maliciously crafted file may lead to arbitrary code execution.

  • CVE-2022-22596HigMar 18, 2022
    Apple Inc.
    Ipados
    risk 0.51cvss 7.8epss 0.00

    A memory corruption issue was addressed with improved validation. This issue is fixed in watchOS 8.5, iOS 15.4 and iPadOS 15.4. An application may be able to execute arbitrary code with kernel privileges.

  • CVE-2022-22593HigMar 18, 2022
    Apple Inc.
    macOS
    risk 0.51cvss 7.8epss 0.01

    A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Security Update 2022-001 Catalina, macOS Monterey 12.2, macOS Big Sur 11.6.3. A malicious application may be able to execute arbitrary…

  • CVE-2022-22591HigMar 18, 2022
    Apple Inc.
    macOS
    risk 0.51cvss 7.8epss 0.01

    A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges.

  • CVE-2022-22590HigMar 18, 2022
    Apple Inc.
    macOS
    risk 0.57cvss 8.8epss 0.02

    A use after free issue was addressed with improved memory management. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Processing maliciously crafted web content may lead to arbitrary code execution.

  • CVE-2022-22585HigMar 18, 2022
    Apple Inc.
    macOS
    risk 0.49cvss 7.5epss 0.02

    An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, macOS Monterey 12.2, macOS Big Sur 11.6.3. An application may be able to access a…

  • CVE-2022-22584HigMar 18, 2022
    Apple Inc.
    macOS
    risk 0.51cvss 7.8epss 0.02

    A memory corruption issue was addressed with improved validation. This issue is fixed in tvOS 15.3, iOS 15.3 and iPadOS 15.3, watchOS 8.4, macOS Monterey 12.2. Processing a maliciously crafted file may lead to arbitrary code execution.

  • CVE-2022-22579HigMar 18, 2022
    Apple Inc.
    macOS
    risk 0.51cvss 7.8epss 0.02

    An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 15.3 and iPadOS 15.3, tvOS 15.3, Security Update 2022-001 Catalina, macOS Monterey 12.2, macOS Big Sur 11.6.3. Processing a maliciously crafted STL file may lead to…

  • CVE-2022-22578HigMar 18, 2022
    Apple Inc.
    macOS
    risk 0.51cvss 7.8epss 0.01

    A logic issue was addressed with improved validation. This issue is fixed in tvOS 15.3, iOS 15.3 and iPadOS 15.3, watchOS 8.4, macOS Monterey 12.2. A malicious application may be able to gain root privileges.

  • CVE-2022-1011HigMar 18, 2022
    Linux
    Kernel
    risk 0.51cvss 7.8epss 0.01

    A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation.

  • CVE-2021-4031HigMar 18, 2022
    Syltek
    Syltek
    risk 0.49cvss 7.5epss 0.00

    Syltek application before its 10.22.00 version, does not correctly check that a product ID has a valid payment associated to it. This could allow an attacker to forge a request and bypass the payment system by marking items as payed without any verification.

  • CVE-2021-30771HigMar 18, 2022
    Apple Inc.
    macOS
    risk 0.51cvss 7.8epss 0.01

    An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.4, iOS 14.6 and iPadOS 14.6, watchOS 7.5, tvOS 14.6. Processing a maliciously crafted font file may lead to arbitrary code execution.

  • CVE-2020-25184HigMar 18, 2022
    Rockwellautomation
    Isagraf Runtime
    risk 0.51cvss 7.8epss 0.00

    Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGRAF Runtime reads the file and saves the data in a variable without any additional modification. A local, unauthenticated…

  • CVE-2020-25178HigMar 18, 2022
    Rockwellautomation
    Isagraf Runtime
    risk 0.49cvss 7.5epss 0.02

    ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP. This communication protocol provides various file system operations, as well as the uploading of applications. Data is transferred over this protocol unencrypted, which…

  • CVE-2022-24772HigMar 18, 2022
    Digitalbazaar
    Forge
    risk 0.42cvss 7.5epss 0.01

    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow…

  • CVE-2022-24771HigMar 18, 2022
    Digitalbazaar
    Forge
    risk 0.42cvss 7.5epss 0.01

    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals…

  • CVE-2022-24655HigMar 18, 2022
    Netgear
    CAX80
    risk 0.51cvss 7.8epss 0.01

    A stack overflow vulnerability exists in the upnpd service in Netgear EX6100v1 201.0.2.28, CAX80 2.1.2.6, and DC112A 1.0.0.62, which may lead to the execution of arbitrary code without authentication.

  • CVE-2022-27191HigMar 18, 2022
    Golang
    SSH
    risk 0.49cvss 7.5epss 0.04

    The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

  • CVE-2022-26965HigMar 18, 2022
    Pluck
    Pluck
    risk 0.53cvss 7.2epss 0.36

    In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution.

  • CVE-2021-45968HigMar 18, 2022
    Pascom
    Cloud Phone System
    risk 0.50cvss 7.5epss 0.10

    An issue was discovered in xmppserver jar in the XMPP Server component of the JIve platform, as used in Pascom Cloud Phone System before 7.20.x (and in other products). An endpoint in the backend Tomcat server of the Pascom allows SSRF, a related issue to CVE-2019-18394.

  • CVE-2022-26504HigMar 17, 2022
    Veeam
    Veeam Backup \& Replication
    risk 0.57cvss 8.8epss 0.02

    Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) allows attackers execute arbitrary code via Veeam.Backup.PSManager.exe

  • CVE-2022-26500HigKEVMar 17, 2022
    Veeam
    Veeam Backup \& Replication
    risk 0.76cvss 8.8epss 0.06

    Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.

  • CVE-2022-24770HigMar 17, 2022
    Gradio Project
    Gradio
    risk 0.50cvss 8.8epss 0.01

    `gradio` is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, `gradio` suffers from Improper Neutralization of Formula Elements in a CSV File. The `gradio` library has a flagging functionality which saves input/output…

  • CVE-2022-21822HigMar 17, 2022
    Nvidia
    Federated Learning Application Runtime Environment
    risk 0.49cvss 7.5epss 0.01

    NVIDIA FLARE contains a vulnerability in the admin interface, where an un-authorized attacker can cause Allocation of Resources Without Limits or Throttling, which may lead to cause system unavailable.

  • CVE-2021-46107HigMar 17, 2022
    Ligeo Archives
    Ligeo Basics
    risk 0.49cvss 7.5epss 0.07

    Ligeo Archives Ligeo Basics as of 02_01-2022 is vulnerable to Server Side Request Forgery (SSRF) which allows an attacker to read any documents via the download features.

  • CVE-2022-26511HigMar 17, 2022
    Kingsoft
    Wps Presentation
    risk 0.51cvss 7.8epss 0.01

    WPS Presentation 11.8.0.5745 insecurely load d3dx9_41.dll when opening .pps files('current directory type' DLL loading).

  • CVE-2022-26081HigMar 17, 2022
    WPS Office
    WPS Office
    risk 0.51cvss 7.8epss 0.01

    The installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll, allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer.

  • CVE-2022-25969HigMar 17, 2022
    WPS Office
    WPS Office
    risk 0.51cvss 7.8epss 0.01

    The installer of WPS Office Version 10.8.0.6186 insecurely load VERSION.DLL (or some other DLLs), allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer.

  • CVE-2022-25949HigMar 17, 2022
    Kingsoft
    Internet Security 9 Plus
    risk 0.51cvss 7.8epss 0.01

    The kernel mode driver kwatch3 of KINGSOFT Internet Security 9 Plus Version 2010.06.23.247 fails to properly handle crafted inputs, leading to stack-based buffer overflow.

  • CVE-2022-26503HigMar 17, 2022
    Veeam
    Veeam
    risk 0.51cvss 7.8epss 0.01

    Deserialization of untrusted data in Veeam Agent for Windows 2.0, 2.1, 2.2, 3.0.2, 4.x, and 5.x allows local users to run arbitrary code with local system privileges.

  • CVE-2022-25364HigMar 17, 2022
    Gradle
    Enterprise
    risk 0.53cvss 8.1epss 0.01

    In Gradle Enterprise before 2021.4.2, the default built-in build cache configuration allowed anonymous write access. If this was not manually changed, a malicious actor with network access to the build cache could potentially populate it with manipulated entries that execute…

  • CVE-2022-24759HigMar 17, 2022
    ChainSafe
    Js Libp2p Noise
    risk 0.53cvss 8.1epss 0.01

    `@chainsafe/libp2p-noise` contains TypeScript implementation of noise protocol, an encryption protocol used in libp2p. `@chainsafe/libp2p-noise` before 4.1.2 and 5.0.3 does not correctly validate signatures during the handshake process. This may allow a man-in-the-middle to pose…

  • CVE-2022-26526HigMar 17, 2022
    Anaconda
    Anaconda3
    risk 0.51cvss 7.8epss 0.00

    Anaconda Anaconda3 (Anaconda Distribution) through 2021.11.0.0 and Miniconda3 through 4.11.0.0 can create a world-writable directory under %PROGRAMDATA% and place that directory into the system PATH environment variable. Thus, for example, local users can gain privileges by…

  • CVE-2022-24761HigMar 17, 2022
    Agendaless
    Waitress
    risk 0.42cvss 7.5epss 0.02

    Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly validate the incoming HTTP request matches the RFC7230 standard, Waitress and the frontend proxy may disagree on where one…

  • CVE-2021-44262HigMar 17, 2022
    Netgear
    WAC104
    risk 0.49cvss 7.5epss 0.02

    A vulnerability is in the 'MNU_top.htm' page of the Netgear W104, version WAC104-V1.0.4.13, which can allow a remote attacker to access this page without any authentication. When processed, it exposes some key information for the device.

  • CVE-2021-44260HigMar 17, 2022
    Wavlink
    AC1200
    risk 0.49cvss 7.5epss 0.06

    A vulnerability is in the 'live_mfg.html' page of the WAVLINK AC1200, version WAVLINK-A42W-1.27.6-20180418, which can allow a remote attacker to access this page without any authentication. When processed, it exposes some key information of the manager of router.

  • CVE-2022-25760HigMar 17, 2022
    Accesslog Project
    Accesslog
    risk 0.46cvss 7.1epss 0.02

    All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If (attacker-controlled) user input is given to the format option of the package's exported constructor function, it is possible…

  • CVE-2022-25354HigMar 17, 2022
    Set In Project
    Set In
    risk 0.49cvss 8.6epss 0.02

    The package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-28273](https://security.snyk.io/vuln/SNYK-JS-SETIN-104…

  • CVE-2022-25352HigMar 17, 2022
    Libnested Project
    Libnested
    risk 0.42cvss 7.5epss 0.02

    The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. **Note:** This vulnerability derives from an incomplete fix for [CVE-2020-28283](https://security.snyk.io/vuln/SNYK-JS-LIBNESTED-1054930)

  • CVE-2022-0749HigMar 17, 2022
    Singoo
    Singoocms.utility
    risk 0.48cvss 7.4epss 0.02

    This affects all versions of package SinGooCMS.Utility. The socket client in the package can pass in the payload via the user-controllable input after it has been established, because this socket client transmission does not have the appropriate restrictions or type bindings for…