Search
Total
201818 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-21679 | 1 Istio | 1 Istio | 2022-01-27 | 7.5 HIGH | 9.8 CRITICAL |
| Istio is an open platform to connect, manage, and secure microservices. In Istio 1.12.0 and 1.12.1 The authorization policy with hosts and notHosts might be accidentally bypassed for ALLOW action or rejected unexpectedly for DENY action during the upgrade from 1.11 to 1.12.0/1.12.1. Istio 1.12 supports the hosts and notHosts fields in authorization policy with a new Envoy API shipped with the 1.12 data plane. A bug in the 1.12.0 and 1.12.1 incorrectly uses the new Envoy API with the 1.11 data plane. This will cause the hosts and notHosts fields to be always matched regardless of the actual value of the host header when mixing 1.12.0/1.12.1 control plane and 1.11 data plane. Users are advised to upgrade or to not mix the 1.12.0/1.12.1 control plane with 1.11 data plane if using hosts or notHosts field in authorization policy. | |||||
| CVE-2022-0326 | 1 Mruby | 1 Mruby | 2022-01-27 | 4.3 MEDIUM | 5.5 MEDIUM |
| NULL Pointer Dereference in Homebrew mruby prior to 3.2. | |||||
| CVE-2021-44121 | 2022-01-27 | N/A | N/A | ||
| ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. | |||||
| CVE-2021-46313 | 1 Gpac | 1 Gpac | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| The binary MP4Box in GPAC v1.0.1 was discovered to contain a segmentation fault via the function __memmove_avx_unaligned_erms (). This vulnerability can lead to a Denial of Service (DoS). | |||||
| CVE-2021-46311 | 1 Gpac | 1 Gpac | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_sg_destroy_routes () at scenegraph/vrml_route.c. This vulnerability can lead to a Denial of Service (DoS). | |||||
| CVE-2021-46240 | 1 Gpac | 1 Gpac | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_dump_vrml_sffield () at scene_manager/scene_dump.c. This vulnerability can lead to a Denial of Service (DoS). | |||||
| CVE-2021-46239 | 1 Gpac | 1 Gpac | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| The binary MP4Box in GPAC v1.1.0 was discovered to contain an invalid free vulnerability via the function gf_free () at utils/alloc.c. This vulnerability can lead to a Denial of Service (DoS). | |||||
| CVE-2021-23460 | 1 Camunda | 1 Min-dash | 2022-01-26 | 5.0 MEDIUM | 7.5 HIGH |
| The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types. | |||||
| CVE-2021-46238 | 1 Gpac | 1 Gpac | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| GPAC v1.1.0 was discovered to contain a stack overflow via the function gf_node_get_name () at scenegraph/base_scenegraph.c. This vulnerability can lead to a program crash, causing a Denial of Service (DoS). | |||||
| CVE-2021-46237 | 1 Gpac | 1 Gpac | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| An untrusted pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_node_unregister () at scenegraph/base_scenegraph.c. This vulnerability can lead to a Denial of Service (DoS). | |||||
| CVE-2021-46236 | 1 Gpac | 1 Gpac | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_sg_vrml_field_pointer_del () at scenegraph/vrml_tools.c. This vulnerability can lead to a Denial of Service (DoS). | |||||
| CVE-2021-46234 | 1 Gpac | 1 Gpac | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_node_unregister () at scenegraph/base_scenegraph.c. This vulnerability can lead to a Denial of Service (DoS). | |||||
| CVE-2022-22895 | 1 Jerryscript | 1 Jerryscript | 2022-01-26 | 6.8 MEDIUM | 7.8 HIGH |
| Jerryscript 3.0.0 was discovered to contain a heap-buffer-overflow via ecma_utf8_string_to_number_by_radix in /jerry-core/ecma/base/ecma-helpers-conversion.c. | |||||
| CVE-2022-22894 | 1 Jerryscript | 1 Jerryscript | 2022-01-26 | 6.8 MEDIUM | 7.8 HIGH |
| Jerryscript 3.0.0 was discovered to contain a stack overflow via ecma_lcache_lookup in /jerry-core/ecma/base/ecma-lcache.c. | |||||
| CVE-2022-22893 | 1 Jerryscript | 1 Jerryscript | 2022-01-26 | 6.8 MEDIUM | 7.8 HIGH |
| Jerryscript 3.0.0 was discovered to contain a stack overflow via vm_loop.lto_priv.304 in /jerry-core/vm/vm.c. | |||||
| CVE-2022-22892 | 1 Jerryscript | 1 Jerryscript | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| There is an Assertion 'ecma_is_value_undefined (value) || ecma_is_value_null (value) || ecma_is_value_boolean (value) || ecma_is_value_number (value) || ecma_is_value_string (value) || ecma_is_value_bigint (value) || ecma_is_value_symbol (value) || ecma_is_value_object (value)' failed at jerry-core/ecma/base/ecma-helpers-value.c in Jerryscripts 3.0.0. | |||||
| CVE-2022-22891 | 1 Jerryscript | 1 Jerryscript | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| Jerryscript 3.0.0 was discovered to contain a SEGV vulnerability via ecma_ref_object_inline in /jerry-core/ecma/base/ecma-gc.c. | |||||
| CVE-2021-40247 | 1 Budget And Expense Tracker System Project | 1 Budget And Expense Tracker System | 2022-01-26 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in Sourcecodester Budget and Expense Tracker System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username field. | |||||
| CVE-2022-22890 | 1 Jerryscript | 1 Jerryscript | 2022-01-26 | 5.0 MEDIUM | 5.5 MEDIUM |
| There is an Assertion 'arguments_type != SCANNER_ARGUMENTS_PRESENT && arguments_type != SCANNER_ARGUMENTS_PRESENT_NO_REG' failed at /jerry-core/parser/js/js-scanner-util.c in Jerryscript 3.0.0. | |||||
| CVE-2022-22888 | 1 Jerryscript | 1 Jerryscript | 2022-01-26 | 6.8 MEDIUM | 7.8 HIGH |
| Jerryscript 3.0.0 was discovered to contain a stack overflow via ecma_op_object_find_own in /ecma/operations/ecma-objects.c. | |||||
| CVE-2021-33966 | 1 Spotweb Project | 1 Spotweb | 2022-01-26 | 3.5 LOW | 5.4 MEDIUM |
| Cross site scripting (XSS) vulnerability in spotweb 1.4.9, allows authenticated attackers to execute arbitrary code via crafted GET request to the login page. | |||||
| CVE-2021-46351 | 1 Jerryscript | 1 Jerryscript | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| There is an Assertion 'local_tza == ecma_date_local_time_zone_adjustment (date_value)' failed at /jerry-core/ecma/builtin-objects/ecma-builtin-date-prototype.c(ecma_builtin_date_prototype_dispatch_set):421 in JerryScript 3.0.0. | |||||
| CVE-2022-23315 | 1 Mingsoft | 1 Mcms | 2022-01-26 | 7.5 HIGH | 9.8 CRITICAL |
| MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do. | |||||
| CVE-2021-46350 | 1 Jerryscript | 1 Jerryscript | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| There is an Assertion 'ecma_is_value_object (value)' failed at jerryscript/jerry-core/ecma/base/ecma-helpers-value.c in JerryScript 3.0.0. | |||||
| CVE-2022-23314 | 1 Mingsoft | 1 Mcms | 2022-01-26 | 7.5 HIGH | 9.8 CRITICAL |
| MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via /ms/mdiy/model/importJson.do. | |||||
| CVE-2021-46349 | 1 Jerryscript | 1 Jerryscript | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| There is an Assertion 'type == ECMA_OBJECT_TYPE_GENERAL || type == ECMA_OBJECT_TYPE_PROXY' failed at /jerry-core/ecma/operations/ecma-objects.c in JerryScript 3.0.0. | |||||
| CVE-2021-40595 | 1 Online Leave Management System Project | 1 Online Leave Management System | 2022-01-26 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in Sourcecodester Online Leave Management System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username parameter to /leave_system/classes/Login.php. | |||||
| CVE-2021-46348 | 1 Jerryscript | 1 Jerryscript | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| There is an Assertion 'ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_p)' failed at /jerry-core/ecma/base/ecma-literal-storage.c in JerryScript 3.0.0. | |||||
| CVE-2021-46347 | 1 Jerryscript | 1 Jerryscript | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| There is an Assertion 'ecma_object_check_class_name_is_object (obj_p)' failed at /jerry-core/ecma/operations/ecma-objects.c in JerryScript 3.0.0. | |||||
| CVE-2022-22930 | 1 Mingsoft | 1 Mcms | 2022-01-26 | 7.5 HIGH | 9.8 CRITICAL |
| A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code via a crafted payload. | |||||
| CVE-2021-46328 | 1 Moddable | 1 Moddable Sdk | 2022-01-26 | 6.8 MEDIUM | 7.8 HIGH |
| Moddable SDK v11.5.0 was discovered to contain a heap-buffer-overflow via the component __libc_start_main. | |||||
| CVE-2021-46346 | 1 Jerryscript | 1 Jerryscript | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| There is an Assertion 'local_tza == ecma_date_local_time_zone_adjustment (date_value)' failed at /jerry-core/ecma/builtin-objects/ecma-builtin-date-prototype.c(ecma_builtin_date_prototype_dispatch_set):421 in JerryScript 3.0.0. | |||||
| CVE-2021-46345 | 1 Jerryscript | 1 Jerryscript | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| There is an Assertion 'cesu8_cursor_p == cesu8_end_p' failed at /jerry-core/lit/lit-strings.c in JerryScript 3.0.0. | |||||
| CVE-2021-46327 | 1 Moddable | 1 Moddable Sdk | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via xs/sources/xsArray.c in fx_Array_prototype_sort. | |||||
| CVE-2021-46344 | 1 Jerryscript | 1 Jerryscript | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| There is an Assertion 'flags & PARSER_PATTERN_HAS_REST_ELEMENT' failed at /jerry-core/parser/js/js-parser-expr.c in JerryScript 3.0.0. | |||||
| CVE-2021-46326 | 1 Moddable | 1 Moddable Sdk | 2022-01-26 | 6.8 MEDIUM | 7.8 HIGH |
| Moddable SDK v11.5.0 was discovered to contain a heap-buffer-overflow via the component __asan_memcpy. | |||||
| CVE-2021-46332 | 1 Moddable | 1 Moddable Sdk | 2022-01-26 | 6.8 MEDIUM | 7.8 HIGH |
| Moddable SDK v11.5.0 was discovered to contain a heap-buffer-overflow via xs/sources/xsDataView.c in fxUint8Getter. | |||||
| CVE-2021-46343 | 1 Jerryscript | 1 Jerryscript | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| There is an Assertion 'context_p->token.type == LEXER_LITERAL' failed at /jerry-core/parser/js/js-parser-expr.c in JerryScript 3.0.0. | |||||
| CVE-2021-46322 | 1 Duktape Project | 1 Duktape | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| Duktape v2.99.99 was discovered to contain a SEGV vulnerability via the component duk_push_tval in duktape/duk_api_stack.c. | |||||
| CVE-2021-46342 | 1 Jerryscript | 1 Jerryscript | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| There is an Assertion 'ecma_is_lexical_environment (obj_p) || !ecma_op_object_is_fast_array (obj_p)' failed at /jerry-core/ecma/base/ecma-helpers.c in JerryScript 3.0.0. | |||||
| CVE-2021-46340 | 1 Jerryscript | 1 Jerryscript | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| There is an Assertion 'context_p->stack_top_uint8 == SCAN_STACK_TRY_STATEMENT || context_p->stack_top_uint8 == SCAN_STACK_CATCH_STATEMENT' failed at /parser/js/js-scanner.c(scanner_scan_statement_end) in JerryScript 3.0.0. | |||||
| CVE-2021-46339 | 1 Jerryscript | 1 Jerryscript | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| There is an Assertion 'lit_is_valid_cesu8_string (string_p, string_size)' failed at /base/ecma-helpers-string.c(ecma_new_ecma_string_from_utf8) in JerryScript 3.0.0. | |||||
| CVE-2021-46338 | 1 Jerryscript | 1 Jerryscript | 2022-01-26 | 5.0 MEDIUM | 5.5 MEDIUM |
| There is an Assertion 'ecma_is_lexical_environment (object_p)' failed at /base/ecma-helpers.c(ecma_get_lex_env_type) in JerryScript 3.0.0. | |||||
| CVE-2021-46337 | 1 Jerryscript | 1 Jerryscript | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| There is an Assertion 'page_p != NULL' failed at /parser/js/js-parser-mem.c(parser_list_get) in JerryScript 3.0.0. | |||||
| CVE-2021-46331 | 1 Moddable | 1 Moddable Sdk | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via xs/sources/xsProxy.c in fxProxyGetPrototype. | |||||
| CVE-2021-46329 | 1 Moddable | 1 Moddable Sdk | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via the component _fini. | |||||
| CVE-2021-46336 | 1 Jerryscript | 1 Jerryscript | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| There is an Assertion 'opts & PARSER_CLASS_LITERAL_CTOR_PRESENT' failed at /parser/js/js-parser-expr.c(parser_parse_class_body) in JerryScript 3.0.0. | |||||
| CVE-2022-22179 | 1 Juniper | 1 Junos | 2022-01-26 | 2.9 LOW | 6.5 MEDIUM |
| A Improper Validation of Specified Index, Position, or Offset in Input vulnerability in the Juniper DHCP daemon (jdhcpd) of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a crash of jdhcpd and thereby a Denial of Service (DoS). In a scenario where DHCP relay or local server is configured the problem can be triggered if a DHCPv4 packet with specific options is received leading to a corruption of the options read from the packet. This corruption can then lead to jdhcpd crash and restart. This issue affects: Juniper Networks Junos OS 17.4R1 and later versions prior to 18.4R3-S10; 19.1 versions prior to 19.1R3-S7; 19.2 versions prior to 19.2R1-S8, 19.2R3-S4; 19.3 versions prior to 19.3R3-S4; 19.4 versions prior to 19.4R3-S6; 20.1 versions prior to 20.1R3-S2; 20.2 versions prior to 20.2R3-S3; 20.3 versions prior to 20.3R3-S2; 20.4 versions prior to 20.4R3-S1; 21.1 versions prior to 21.1R2-S2, 21.1R3; 21.2 versions prior to 21.2R1-S2, 21.2R2, 21.2R3; 21.3 versions prior to 21.3R1-S1, 21.3R2. | |||||
| CVE-2021-46330 | 1 Moddable | 1 Moddable Sdk | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via xs/sources/xsDataView.c in fx_ArrayBuffer_prototype_concat. | |||||
| CVE-2021-46335 | 1 Moddable | 1 Moddable Sdk | 2022-01-26 | 4.3 MEDIUM | 5.5 MEDIUM |
| Moddable SDK v11.5.0 was discovered to contain a NULL pointer dereference in the component fx_Function_prototype_hasInstance. | |||||