Improper input validation in some Intel(R) Neural Compressor software before version 2.5.0 may allow an unauthenticated user to potentially enable escalation of privilege via remote access.
Source: Intel Corporation
Max CVSS
10.0
EPSS Score
0.04%
Published
2024-05-16
Updated
2024-05-17
Implementations of IPMI Authenticated sessions does not provide enough randomness to protect from session hijacking, allowing an attacker to use either predictable IPMI Session ID or weak BMC Random Number to bypass security controls using spoofed IPMI packets to manage BMC device.
Source: CERT/CC
Max CVSS
9.1
EPSS Score
0.05%
Published
2024-04-30
Updated
2024-07-03
Protection mechanism failure in some Intel DCM software before version 5.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
Source: Intel Corporation
Max CVSS
10.0
EPSS Score
0.10%
Published
2023-11-14
Updated
2023-11-25
Cross-site scripting (XSS) for the Intel(R) DSA software before version 23.1.9 may allow unauthenticated user to potentially enable escalation of privilege via network access.
Source: Intel Corporation
Max CVSS
9.6
EPSS Score
0.11%
Published
2023-08-11
Updated
2023-08-18
Improper access control in the Intel(R) Ethernet Controller RDMA driver for linux before version 1.9.30 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
Source: Intel Corporation
Max CVSS
9.8
EPSS Score
0.08%
Published
2023-08-11
Updated
2024-01-11
Improper input validation in the Intel(R) SUR software before version 2.4.8902 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
Source: Intel Corporation
Max CVSS
9.8
EPSS Score
0.18%
Published
2023-02-16
Updated
2023-02-27
In ConnMan through 1.41, remote attackers able to send HTTP requests to the gweb component are able to exploit a heap-based buffer overflow in received_data to execute code.
Source: MITRE
Max CVSS
9.8
EPSS Score
2.05%
Published
2022-08-03
Updated
2023-12-21
Insufficiently protected credentials for Intel(R) AMT and Intel(R) Standard Manageability may allow an unauthenticated user to potentially enable information disclosure and escalation of privilege via network access.
Source: Intel Corporation
Max CVSS
9.8
EPSS Score
0.30%
Published
2022-08-18
Updated
2023-05-22
Cross-site Scripting (XSS) in some Intel(R) Manageability Commander software before version 2.3 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
Source: Intel Corporation
Max CVSS
9.6
EPSS Score
0.11%
Published
2023-08-11
Updated
2023-08-16
Improper access control in the Intel(R) SUR software before version 2.4.8902 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
Source: Intel Corporation
Max CVSS
9.8
EPSS Score
0.21%
Published
2023-02-16
Updated
2023-02-27
Improper buffer restrictions in the Hyperscan library maintained by Intel(R) all versions downloaded before 04/29/2022 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
Source: Intel Corporation
Max CVSS
9.8
EPSS Score
0.20%
Published
2022-11-11
Updated
2022-11-17
Improper authentication in firmware for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
Source: Intel Corporation
Max CVSS
9.8
EPSS Score
0.14%
Published
2022-11-11
Updated
2023-05-22
Insufficient visual distinction of homoglyphs presented to user in the Intel(R) oneAPI DPC++/C++ Compiler before version 2022.1 for Intel(R) oneAPI Toolkits before version 2022.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
Source: Intel Corporation
Max CVSS
9.8
EPSS Score
0.18%
Published
2023-02-16
Updated
2023-03-02
Out-of-bounds write in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Source: Intel Corporation
Max CVSS
9.6
EPSS Score
0.06%
Published
2022-11-11
Updated
2022-11-16
Improper handling of Unicode encoding in source code to be compiled by the Intel(R) C++ Compiler Classic before version 2021.6 for Intel(R) oneAPI Toolkits before version 2022.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
Source: Intel Corporation
Max CVSS
9.8
EPSS Score
0.18%
Published
2023-02-16
Updated
2023-02-28
Authentication bypass for the Open AMT Cloud Toolkit software maintained by Intel(R) before versions 2.0.2 and 2.2.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
Source: Intel Corporation
Max CVSS
9.8
EPSS Score
0.20%
Published
2022-08-18
Updated
2022-08-22
An issue was discovered in the DNS proxy in Connman through 1.40. forward_dns_reply mishandles a strnlen call, leading to an out-of-bounds read.
Source: MITRE
Max CVSS
9.1
EPSS Score
0.28%
Published
2022-01-28
Updated
2023-12-21
An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation lacks a check for the presence of sufficient Header Data, leading to an out-of-bounds read.
Source: MITRE
Max CVSS
9.1
EPSS Score
0.28%
Published
2022-01-28
Updated
2023-12-21
Improper authentication in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
Source: Intel Corporation
Max CVSS
9.8
EPSS Score
0.20%
Published
2022-08-18
Updated
2022-08-19

CVE-2021-45046

Known exploited
Public exploit
Used for ransomware
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
Source: Apache Software Foundation
Max CVSS
9.0
EPSS Score
97.41%
Published
2021-12-14
Updated
2024-06-27
CISA KEV Added
2023-05-01

CVE-2021-44228

Known exploited
Public exploit
Used for ransomware
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
Source: Apache Software Foundation
Max CVSS
10.0
EPSS Score
97.56%
Published
2021-12-10
Updated
2023-04-03
CISA KEV Added
2021-12-10
ConnMan (aka Connection Manager) 1.30 through 1.39 has a stack-based buffer overflow in uncompress in dnsproxy.c via NAME, RDATA, or RDLENGTH (for A or AAAA).
Source: MITRE
Max CVSS
9.8
EPSS Score
0.41%
Published
2021-06-09
Updated
2022-02-09
Insufficient control flow management in the Open WebRTC Toolkit before version 4.3.1 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
Source: Intel Corporation
Max CVSS
9.8
EPSS Score
0.22%
Published
2020-11-13
Updated
2020-11-23
Path traversal in the Intel(R) EMA before version 1.3.3 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
Source: Intel Corporation
Max CVSS
9.8
EPSS Score
0.28%
Published
2020-11-12
Updated
2020-11-20
NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which software allows an attacker to upload or transfer files that can be automatically processed within the product's environment, which may lead to remote code execution.
Source: NVIDIA Corporation
Max CVSS
9.8
EPSS Score
0.85%
Published
2020-10-29
Updated
2020-11-05
52 vulnerabilities found
1 2 3
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!