CVE Vulnerability Catalog

Improper input validation in the firmware for some Intel processors may allow a privileged user to potentially enable escalation of privilege via local access.

Race condition in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. The vulnerability affects Intel processors.

Domain-bypass transient execution vulnerability in some Intel Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. The flaw relates to processor speculative execution mechanisms.

Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

Improper input validation in the firmware for some Intel processors may allow an authenticated user to potentially enable denial of service via local access.

Insufficient control flow management in the firmware for some Intel(R) Processors may allow an unauthenticated user to potentially enable escalation of privilege via physical access.

Out of bounds write in the firmware for some Intel processors may allow a privileged user to potentially enable denial of service via local access.

Improper initialization in the firmware for some Intel processors may allow a privileged user to potentially enable escalation of privilege via local access.

ASP.NET Core has a Denial of Service (DoS) vulnerability that could lead to service overload and unavailability.

In vFairs 3.3, any logged-in user can modify any other user's profile to inject malicious JavaScript (XSS). The database stores HTML tags that are rendered on the page, enabling XSS attacks.

vFairs 3.3 is affected by insecure permissions, allowing any logged-in user to modify other users' profile information or pictures. By knowing a user's unique ID, an attacker can send an HTTP POST request to change profile details or upload a new image.

Centreon version 20.10.2 is affected by a stored XSS vulnerability. The dep_description and dep_name parameters are vulnerable to script injection, requiring login and navigation to Configuration > Notifications > Hosts.

A stored cross-site scripting (XSS) vulnerability was found in the LuCI web interface for OpenWRT version 19.07. It allows an attacker to inject arbitrary JavaScript via the Hostname change operation.

The LuCI web interface for OpenWRT version 19.07 and lower has been found to have a cross-site scripting (XSS) vulnerability.

There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.