SUSE SLED15: jackson-annotations / jackson-annotations-javadoc / jackson-bom / etc (SUSE-SU-2022:1678-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1678-1 advisory. Security issues fixed: - CVE-2020-36518: Fixed a Java stack overflow exception and denial of...

CVE-2022-30775

xpdf 4.04 allocates excessive memory when presented with crafted input. This can be triggered by for example sending a crafted PDF document to the pdftoppm binary. It is most easily reproduced with the DCMAKECXXCOMPILER=afl-clang-fast++ option...

Checkbox Survey Web Detection

Binary data checkboxsurveywebapidetect.nbin...

PT-2022-20309 · Xpdf +1 · Xpdf +1

Name of the Vulnerable Software and Affected Versions: xpdf version 4.04 Description: The issue arises when xpdf allocates excessive memory in response to crafted input. This can be triggered by sending a crafted PDF document to the pdftoppm binary. It is most easily reproduced with the DCMAKE CX...

CVE-2020-16845

A flaw was found in the Go encoding/binary package. Certain invalid inputs to the ReadUvarint or the ReadVarint causes those functions to read an unlimited number of bytes from the ByteReader argument before returning an error. This flaw possibly leads to processing more input than expected. The...

GHSA-GVGC-RXMH-5HVW Apache Tomcat affected by infinite loop in Double.parseDouble method in Java Runtime Environment

The Double.parseDouble method in Java Runtime Environment JRE in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.229 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a...

Apache Tomcat affected by infinite loop in Double.parseDouble method in Java Runtime Environment

The Double.parseDouble method in Java Runtime Environment JRE in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.229 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a...

GHSA-9VJF-JJCQ-3GH7 Mercurial arbitrary code execution vulnerability

The binary delta decoder in Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a 1 clone, 2 push, or 3 pull command, related to a a list sizing rounding error and b short records...

@binary-com/binary-style (>=0.2.4, <=0.2.26), @dfeidao/widgets (>=4.6.201904011830, <=4.6.201904291719) +10 more potentially affected by CVE-2016-10744 via select2 (>=4.0.1, <=4.0.5)

select2 NPM version =4.0.1, =0.2.4, =4.6.201904011830, =0.1.0, =2.3.1, =0.11.28, =0.0.1, =0.1.0, =0.0.1, =1.0.0, =1.0.1 Source cves: CVE-2016-10744 Source advisory: OSV:GHSA-RF66-HMQF-Q3FC...

Moodle Authenticated Spelling Binary Remote Code Execution

Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor...

GHSA-WXQG-FG7V-MMC6 Moodle Authenticated Spelling Binary Remote Code Execution

Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor...

Adobe InCopy Installed (Windows)

Binary data adobeincopywininstalled.nbin...

Adobe InCopy Installed (macOS)

Binary data adobeincopymacinstalled.nbin...

ManageEngine Password Manager Pro REST API Restriction Bypass (CVE-2022-29081)

Binary data manageenginepmpcve-2022-29081.nbin...

Sophos XG Firewall User Portal and Webadmin Authentication Bypass (CVE-2022-1040)

Binary data sophosxgfirewallcve-2022-1040.nbin...

CVE-2022-26042

An OS command injection vulnerability exists in the daretools binary functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability...

CVE-2022-26042: Improper Neutralization of Special Elements used in a Command

An OS command injection vulnerability exists in the daretools binary functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability...

malicious crate `rustdecimal`

The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained malware. The crate name was intentionally similar to the name of the popular rustdecimal2 crate, hoping that potential victims would misspell its...

RUSTSEC-2022-0042 malicious crate `rustdecimal`

The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained malware. The crate name was intentionally similar to the name of the popular rustdecimal2 crate, hoping that potential victims would misspell its...

radare2 代码问题漏洞

Radare2 is a set of libraries and tools for working with binary files. A denial of service vulnerability exists in Radare2 versions prior to 5.7.0, which stems from a null pointer dereference in libr/bin/format/mach0/mach0.c. The vulnerability can be exploited to cause a denial of service. An...