NVD disclosure day
CVE-2021-3560
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
An unprivileged local user can exploit a flaw in polkit to bypass security checks and gain root privileges. This could impact data integrity, confidentiality, and system availability for affected organizations. The primary business risk involves unauthorized administrative access.
CVE-2022-24086
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
Adobe Commerce and Magento Open Source are affected by an input validation flaw in the checkout process, allowing unauthorized code execution. This exposes businesses to data compromise and operational disruption. Attackers can exploit this remotely, posing a significant risk to affected systems.
CVE-2022-25236
Halo Surface Signal: 3 out of 5 — possibly public-facing.
The Expat XML parsing library contains a vulnerability that permits the insertion of namespace-separator characters into namespace URIs, which could lead to unexpected service behavior if reached. This issue impacts applications that process external, untrusted XML input.
CVE-2022-25235
Halo Surface Signal: 3 out of 5 — possibly public-facing.
Expat, an XML parsing library, has a critical vulnerability due to incomplete encoding validation. This could allow attackers to send malformed data to trigger unintended behavior or data disclosure in applications using the library, such as web servers or remote management systems. The broad use of Expat means this is