jpress v4.2.0 allows users to register an account by default. With the account, user can upload arbitrary files to the server. CVSSv3.1 8.8 (HIGH) · EPSS 74th percentile
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists. CVSSv3.1 8.8 (HIGH) · EPSS 86th percentile
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to us CVSSv3.1 9.8 (CRITICAL) · EPSS 93th percentile
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically co CVSSv3.1 8.8 (HIGH) · EPSS 74th percentile
The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495. CVSSv3.1 9.8 (CRITICAL) · EPSS 77th percentile
The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494. CVSSv3.1 9.8 (CRITICAL)
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution. CVSSv3.1 9.8 (CRITICAL) · EPSS 91th percentile
The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution. CVSSv3.1 9.8 (CRITICAL)
jpress v4.2.0 is vulnerable to command execution via io.jpress.web.admin._AddonController::doUploadAndInstall. CVSSv3.1 9.8 (CRITICAL) · EPSS 83th percentile
jpress v4.2.0 admin panel provides a function through which attackers can modify the template and inject some malicious code. CVSSv3.1 8.8 (HIGH)
Microsoft Office Remote Code Execution Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 93th percentile
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition. This vulnerability is due to improper input validation when parsing HTTPS requests. An attacker could exploit this vulnerability by sending a malicious HTTPS request to an affected device. A successful exploit could allow the attacker t CVSSv3.1 8.6 (HIGH) · EPSS 68th percentile
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition. This vulnerability is due to improper input validation when parsing HTTPS requests. An attacker could exploit this vulnerability by sending a malicious HTTPS request to an affected device. A successful exploit could allow the attacker t CVSSv3.1 8.6 (HIGH) · EPSS 68th percentile
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. CVSSv3.1 8.8 (HIGH) · EPSS 86th percentile
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. CVSSv3.1 8.8 (HIGH) · EPSS 86th percentile
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. CVSSv3.1 8.8 (HIGH) · EPSS 85th percentile
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. CVSSv3.1 9.8 (CRITICAL)
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. CVSSv3.1 9.8 (CRITICAL) · EPSS 89th percentile
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. CVSSv3.1 9.8 (CRITICAL) · EPSS 92th percentile
In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. CVSSv3.1 8.1 (HIGH) · EPSS 90th percentile
An issue was discovered in SdHostDriver in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (CommBufferData). CVSSv3.1 8.2 (HIGH) · EPSS 20th percentile
An issue was discovered in IdeBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (the status code saved at the CommBuffer+4 location). CVSSv3.1 8.2 (HIGH) · EPSS 25th percentile
An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (the CommBuffer+8 location). CVSSv3.1 8.2 (HIGH) · EPSS 20th percentile
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory). CVSSv3.1 8.8 (HIGH) · EPSS 91th percentile
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2. CVSSv3.1 6.6 (MEDIUM) · EPSS 98th percentile