Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,375 results · page 13 of 28
Sep 23, 2022A Denial-of-Service vulnerability was discovered in the F-Secure and WithSecure products where aerdl.so/aerdl.dll may go into an infinite loop when unpacking PECVE-2022-28886 · Other software · F-Secure and WithSecure · reported by cve-notifications-us@f-secure.comMedium 4.3
A Denial-of-Service vulnerability was discovered in the F-Secure and WithSecure products where aerdl.so/aerdl.dll may go into an infinite loop when unpacking PE files. It is possible that this can crash the scanning engine
- Product
- All F-Secure and WithSecure Endpoint Protection products for Windows running 32 bit operating system. F-Secure Linux Security 32 F-Secure Internet Gatekeeper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordf-secure.comwithsecure.com
Sep 13, 2022Infinite loop in the F5 Ethernet Trailer protocol dissector in Wireshark 3.6.0 to 3.6.7 and 3.4.0 to 3.4.15 allows denial of service via packet injection or craCVE-2022-3190 · Other software · SharkFest Foundation · reported by cve@gitlab.comMedium 6.3
Infinite loop in the F5 Ethernet Trailer protocol dissector in Wireshark 3.6.0 to 3.6.7 and 3.4.0 to 3.4.15 allows denial of service via packet injection or crafted capture file
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2022PDF Labs pdftk-java v3.2.3 was discovered to contain an infinite loop via the component /text/pdf/PdfReader.java.CVE-2021-37819 · Other software · Pdftk-java Project · reported by MITREHigh 7.5
PDF Labs pdftk-java v3.2.3 was discovered to contain an infinite loop via the component /text/pdf/PdfReader.java.
- Product
- Pdftk-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2022WordPress Infinite Scroll – Ajax Load More: Directory TraversalCVE-2022-2945 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.5.3 via the 'type' parameter found in the alm_get_layout() function. This makes it possible for authenticated attackers, with administrative permissions, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- WordPress Infinite Scroll – Ajax Load More
- Affected
- up to 5.5.3
- What to do
- Affects up to 5.5.3. Update WordPress Infinite Scroll – Ajax Load More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.svn.wordpress.org
Sep 6, 2022WordPress Infinite Scroll – Ajax Load More: Arbitrary file readingCVE-2022-2943 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WordPress Infinite Scroll – Ajax Load More plugin for Wordpress is vulnerable to arbitrary file reading in versions up to, and including, 5.5.3 due to insufficient file path validation on the alm_repeaters_export() function. This makes it possible for authenticated attackers, with administrative privileges, to download arbitrary files hosted on the server that may contain sensitive content, such as the wp-config.php file.
- Product
- WordPress Infinite Scroll – Ajax Load More
- Affected
- up to 5.5.3
- What to do
- Affects up to 5.5.3. Update WordPress Infinite Scroll – Ajax Load More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.svn.wordpress.org
Sep 6, 2022WordPress Infinite Scroll – Ajax Load More: Deserialization of untrusted inputCVE-2022-2433 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to deserialization of untrusted input via the 'alm_repeaters_export' parameter in versions up to, and including 5.5.3. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they can trick a site administrator into performing an action such as clicking on a link, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
- Product
- WordPress Infinite Scroll – Ajax Load More
- Affected
- up to 5.5.3
- What to do
- Affects up to 5.5.3. Update WordPress Infinite Scroll – Ajax Load More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Sep 6, 2022A Denial-of-Service vulnerability was discovered in the F-Secure and WithSecure products where aerdl.dll may go into an infinite loop when unpacking PE files.CVE-2022-28884 · Other software · F-Secure and WithSecure · reported by cve-notifications-us@f-secure.comMedium 4.3
A Denial-of-Service vulnerability was discovered in the F-Secure and WithSecure products where aerdl.dll may go into an infinite loop when unpacking PE files. It is possible that this can crash the scanning engine.
- Product
- All F-Secure and WithSecure Endpoint Protection products for Windows and Mac running 32 bit operating system. F-Secure Linux Security 32 F-Secure Atlant F-Secu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwithsecure.comwithsecure.com
Sep 2, 2022wolfSSL through 5.0.0 allows an attacker to cause a denial of service and infinite loop in the client component by sending crafted traffic from a Machine-in-theCVE-2021-44718 · Other software · Wolfssl · reported by MITREMedium 5.9
wolfSSL through 5.0.0 allows an attacker to cause a denial of service and infinite loop in the client component by sending crafted traffic from a Machine-in-the-Middle (MITM) position. The root cause is that the client module accepts TLS messages that normally are only sent to TLS servers.
- Product
- Wolfssl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2022A Denial-of-Service (DoS) vulnerability was discovered in F-Secure & WithSecure products whereby the aegen.dll will go into an infinite loop when unpacking PE fCVE-2022-28882 · Other software · F-Secure and WithSecure · reported by cve-notifications-us@f-secure.comMedium 4.3
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure & WithSecure products whereby the aegen.dll will go into an infinite loop when unpacking PE files. This eventually leads to scanning engine crash. The exploit can be triggered remotely by an attacker.
- Product
- All F-Secure and WithSecure Endpoint Protection products for Windows & Mac F-Secure Linux Security (32-bit) F-Secure Linux Security (64-bit) F-Secure Atlant F-S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwithsecure.comwithsecure.com
Aug 22, 2022Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to alter CSRF settings directly.CVE-2022-35656 · Other software · Pegasystems · reported by security@pega.comMedium 4.5
Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to alter CSRF settings directly.
- Product
- Pega Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.pega.comsupport.pega.com
Aug 22, 2022Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a datapage setting.CVE-2022-35655 · Other software · Pegasystems · reported by security@pega.comMedium 6.1
Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a datapage setting.
- Product
- Pega Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.pega.comsupport.pega.com
Aug 22, 2022Pega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.CVE-2022-35654 · Other software · Pegasystems · reported by security@pega.comMedium 6.1
Pega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.
- Product
- Pega Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.pega.comsupport.pega.com
Aug 18, 2022libjpeg commit 281daa9 was discovered to contain an infinite loop via the component Frame::ParseTrailer.CVE-2022-37768 · Other software · Jpeg · reported by MITREHigh 7.5
libjpeg commit 281daa9 was discovered to contain an infinite loop via the component Frame::ParseTrailer.
- Product
- Libjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022libjpeg commit 842c7ba was discovered to contain an infinite loop via the component JPEG::ReadInternal.CVE-2022-35166 · Other software · Jpeg · reported by MITREMedium 5.5
libjpeg commit 842c7ba was discovered to contain an infinite loop via the component JPEG::ReadInternal.
- Product
- Libjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2022An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring.CVE-2020-14394 · Other software · Qemu · reported by Red HatLow 3.2
An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. This flaw allows a privileged guest user to hang the QEMU process on the host, resulting in a denial of service.
- Product
- Qemu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgitlab.com
Aug 16, 2022Endless Infinite loop in Blender-thumnailing due to logical bugs.CVE-2022-2833 · Other software · Blender · reported by Red HatHigh 7.5
Endless Infinite loop in Blender-thumnailing due to logical bugs.
- Product
- Blender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.blender.orgdeveloper.blender.org
Aug 1, 2022graphql-go (aka GraphQL for Go) through 0.8.0 has infinite recursion in the type definition parser.CVE-2022-37315 · Other software · Graphql-go Project · reported by MITREHigh 7.5
graphql-go (aka GraphQL for Go) through 0.8.0 has infinite recursion in the type definition parser.
- Product
- Graphql-go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenwall.com
Jul 25, 2022Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks.CVE-2022-24083 · Other software · Pegasystems · reported by security@pega.comCritical 9.8
Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks.
- Product
- Pega Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.pega.comsupport.pega.com
Jul 23, 2022A vulnerability was found in InfiniteWP Client Plugin 1.5.1.3/1.6.0.CVE-2016-15004 · Other software · unspecified · reported by VulDBHigh 7.3
A vulnerability was found in InfiniteWP Client Plugin 1.5.1.3/1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to injection. The attack can be launched remotely. Upgrading to version 1.6.1.1 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- InfiniteWP Client Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsumofpwn.nl
Jul 19, 2022If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly CVE-2022-24082 · Other software · Pegasystems · reported by security@pega.comCritical 9.8
If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it may be possible to upload serialized payloads to attack the underlying system. This does not affect systems running on PegaCloud due to its design and architecture.
- Product
- Pega Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsupport.pega.com
Jul 17, 2022Pexip Infinity before 28.1 allows remote attackers to trigger a software abort via G.719.CVE-2022-32263 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 28.1 allows remote attackers to trigger a software abort via G.719.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity 27 before 28.0 allows remote attackers to trigger excessive resource consumption and termination because of registrar resource mishandling.CVE-2022-29286 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity 27 before 28.0 allows remote attackers to trigger excessive resource consumption and termination because of registrar resource mishandling.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity before 27.3 allows remote attackers to trigger excessive resource consumption via H.264.CVE-2022-27937 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 27.3 allows remote attackers to trigger excessive resource consumption via H.264.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via H.323.CVE-2022-27936 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via H.323.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via Epic Telehealth.CVE-2022-27935 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via Epic Telehealth.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via HTTP.CVE-2022-27934 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via HTTP.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.CVE-2022-27933 · Other software · Pexip · reported by MITREHigh 8.2
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.CVE-2022-27932 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.CVE-2022-27931 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via single-sign-on if a random Universally Unique Identifier is guessed.CVE-2022-27930 · Other software · Pexip · reported by MITREMedium 5.9
Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via single-sign-on if a random Universally Unique Identifier is guessed.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via HTTP.CVE-2022-27929 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via HTTP.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.CVE-2022-27928 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.CVE-2022-26657 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join.CVE-2022-26656 · Other software · Pexip · reported by MITREHigh 8.2
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity 27.x before 27.3 has Improper Input Validation.CVE-2022-26655 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity 27.x before 27.3 has Improper Input Validation. The client API allows remote attackers to trigger a software abort via a gateway call into Teams.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity before 27.3 allows remote attackers to force a software abort via HTTP.CVE-2022-26654 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 27.3 allows remote attackers to force a software abort via HTTP.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity 27.x before 27.2 has Improper Access Control.CVE-2022-25357 · Other software · Pexip · reported by MITREMedium 5.3
Pexip Infinity 27.x before 27.2 has Improper Access Control. An attacker can sometimes join a conference (call join) if it has a lock but not a PIN.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 15, 2022Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 <<CVE-2022-30634 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes.
- Product
- crypto/rand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2022A CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability exists that could cause a denial of service of the webserver due to improper hanCVE-2022-34760 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.5
A CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability exists that could cause a denial of service of the webserver due to improper handling of the cookies. Affected Products: X80 advanced RTU Communication Module (BMENOR2200H) (V1.0), OPC UA Modicon Communication Module (BMENUA0100) (V1.10 and prior)
- Product
- OPC UA Modicon Communication Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jul 7, 2022An infinite loop in the function httpRpmPass of TP-Link TL-WR741N/TL-WR742N V1/V2/V3_130415 allows attackers to cause a Denial of Service (DoS) via a crafted paCVE-2022-32058 · Network & remote access · Tp-link · reported by MITREHigh 7.5
An infinite loop in the function httpRpmPass of TP-Link TL-WR741N/TL-WR742N V1/V2/V3_130415 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
- Product
- Tl-wr741n Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams.CVE-2022-31108 · Other software · mermaid-js · reported by GitHubMedium 4.1
Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. An attacker is able to inject arbitrary `CSS` into the generated graph allowing them to change the styling of elements outside of the generated graph, and potentially exfiltrate sensitive information by using specially crafted `CSS` selectors. The following example shows how an attacker can exfiltrate the contents of an input field by bruteforcing the `value` attribute one character at a time. Whenever there is an actual match, an `http` request will be made by the browser in order to "load" a background image that will let an attacker know what's the value of the character. This issue may lead to `Information Disclosure` via CSS selectors and functions able to generate HTTP requests. This also allows an attacker to change the document in ways which may lead a user to perform unintended actions, such as clicking on a link, etc. This issue has been resolved in version 9.1.3. Users are advised to upgrade. Users unable to upgrade should ensure that user input is adequately escaped before embedding it in CSS blocks.
- Product
- mermaid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022The tested version of Dominion Voting System ImageCast X can be manipulated to cause arbitrary code execution by specially crafted election definition files.CVE-2022-1743 · Other software · Dominion Voting System · reported by ics-cert@hq.dhs.govMedium 6.8
The tested version of Dominion Voting System ImageCast X can be manipulated to cause arbitrary code execution by specially crafted election definition files. An attacker could leverage this vulnerability to spread malicious code to ImageCast X devices from the EMS.
- Product
- ImageCast X application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2022python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial CVE-2021-46823 · Other software · Python-ldap · reported by MITREMedium 6.5
python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. By sending crafted regex input, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition.
- Product
- Python-ldap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comgithub.com
Jun 16, 2022An infinite loop in OPC UA .NET Standard Stack 1.04.368 allows a remote attackers to cause the application to hang via a crafted message.CVE-2022-29862 · Other software · Opcfoundation · reported by MITREHigh 7.5
An infinite loop in OPC UA .NET Standard Stack 1.04.368 allows a remote attackers to cause the application to hang via a crafted message.
- Product
- UA .net Standard Stack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfiles.opcfoundation.orgopcfoundation.org
Jun 15, 2022In static definitions of GattServiceConfig.java, there is a possible permission bypass due to an insecure default value.CVE-2022-20207 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In static definitions of GattServiceConfig.java, there is a possible permission bypass due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-185513714
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 10, 2022The package jpeg-js before 0.4.4 are vulnerable to Denial of Service (DoS) where a particular piece of input will cause to enter an infinite loop and never retuCVE-2022-25851 · Other software · Jpeg-js Project · reported by report@snyk.ioHigh 7.5
The package jpeg-js before 0.4.4 are vulnerable to Denial of Service (DoS) where a particular piece of input will cause to enter an infinite loop and never return.
- Product
- Jpeg-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2022GPAC version before commit 71460d72ec07df766dab0a4d52687529f3efcf0a (version v1.0.1 onwards) contains loop with unreachable exit condition ('infinite loop') vulCVE-2021-40592 · Other software · Gpac · reported by MITREMedium 5.5
GPAC version before commit 71460d72ec07df766dab0a4d52687529f3efcf0a (version v1.0.1 onwards) contains loop with unreachable exit condition ('infinite loop') vulnerability in ISOBMFF reader filter, isoffin_read.c. Function isoffin_process() can result in DoS by infinite loop. To exploit, the victim must open a specially crafted mp4 file.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022Thinfinity VNC v4.0.0.1 contains a Cross-Origin Resource Sharing (CORS) vulnerability which can allow an unprivileged remote attacker, if they can trick a user CVE-2022-25227 · Other software · Cybelesoft · reported by help@fluidattacks.comHigh 8.8
Thinfinity VNC v4.0.0.1 contains a Cross-Origin Resource Sharing (CORS) vulnerability which can allow an unprivileged remote attacker, if they can trick a user into browse malicious site, to obtain an 'ID' that can be used to send websocket requests and achieve RCE.
- Product
- Thinfinity VNC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comfluidattacks.com
Apr 4, 2022In HTMLDOC 1.9.14, an infinite loop in the gif_read_lzw function can lead to a pointer arbitrarily pointing to heap memory and resulting in a buffer overflow.CVE-2022-24191 · Other software · Htmldoc Project · reported by MITREMedium 5.5
In HTMLDOC 1.9.14, an infinite loop in the gif_read_lzw function can lead to a pointer arbitrarily pointing to heap memory and resulting in a buffer overflow.
- Product
- Htmldoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Mar 29, 2022A stack overflow re2c 2.2 exists due to infinite recursion issues in src/dfa/dead_rules.cc.CVE-2022-23901 · Other software · Re2c · reported by MITRECritical 9.8
A stack overflow re2c 2.2 exists due to infinite recursion issues in src/dfa/dead_rules.cc.
- Product
- Re2c
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.