PT-2022-12748

Name of the Vulnerable Software and Affected Versions Jsish version 3.5.0 Description A heap-use-after-free issue was discovered in Jsish, which can lead to a Denial of Service DoS. The issue is related to the /usr/lib/x86 64-linux-gnu/libasan.so.4+0x79732 endpoint. Recommendations For Jsish...

PT-2022-12788

Name of the Vulnerable Software and Affected Versions Cesanta MJS version 2.20.0 Description The issue is related to a SEGV vulnerability that can be triggered via /lib/x86 64-linux-gnu/libc.so.6+0x4b44b, leading to a Denial of Service DoS. Recommendations For Cesanta MJS version 2.20.0, at the...

CVE-2022-23935

lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file = /|$/ check, leading to command injection...

CVE-2022-23935: Improper Neutralization of Special Elements used in an OS Command

lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file = /|$/ check, leading to command injection...

CVE-2021-24906

The Protect WP Admin WordPress plugin before 3.6.2 does not check for authorisation in the lib/pwa-deactivate.php file, which could allow unauthenticated users to disable the plugin and therefore the protection offered via a crafted request...

CVE-2021-26706

An issue was discovered in libmem.c in Micrium uC/OS uC/LIB 1.38.x and 1.39.00. The following memory allocation functions do not check for integer overflow when allocating a pool whose size exceeds the address space: MemPoolCreate, MemDynPoolCreate, and MemDynPoolCreateHW. Because these functions...

CVE-2021-26706

An issue was discovered in libmem.c in Micrium uC/OS uC/LIB 1.38.x and 1.39.00. The following memory allocation functions do not check for integer overflow when allocating a pool whose size exceeds the address space: MemPoolCreate, MemDynPoolCreate, and MemDynPoolCreateHW. Because these functions...

PT-2022-9788

Name of the Vulnerable Software and Affected Versions Micrium uC/OS uC/LIB versions 1.38.x through 1.39.00 Description An issue was discovered in the memory allocation functions Mem PoolCreate, Mem DynPoolCreate, and Mem DynPoolCreateHW in lib mem.c. These functions do not check for integer...

CVE-2021-24906: Missing Authorization

The Protect WP Admin WordPress plugin before 3.6.2 does not check for authorisation in the lib/pwa-deactivate.php file, which could allow unauthenticated users to disable the plugin and therefore the protection offered via a crafted request...

CVE-2021-26706: Integer Overflow or Wraparound

An issue was discovered in libmem.c in Micrium uC/OS uC/LIB 1.38.x and 1.39.00. The following memory allocation functions do not check for integer overflow when allocating a pool whose size exceeds the address space: MemPoolCreate, MemDynPoolCreate, and MemDynPoolCreateHW. Because these functions...

com.elasticbox.jenkins-ci.plugins:elasticbox (>=4.0.9, <=4.1.0), org.jenkins-ci.lib:xtrigger-lib (0.36) +5 more potentially affected by CVE-2022-20612 via org.jenkins-ci.main:jenkins-core (1.644)

org.jenkins-ci.main:jenkins-core MAVEN version 1.644 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.elasticbox.jenkins-ci.plugins:elasticbox =4.0.9, =4.0.4, =1.0.45, =1.0.47 Source cves:...

PT-2022-7175

Name of the Vulnerable Software and Affected Versions SysAid versions prior to 22.1.64 SysAid versions prior to 22.2.20 Description The issue is related to an incorrect restriction of a directory path with limited access in the /lib/tinymce/examples/index.html component of the SysAid software. Th...

GHSA-GP6J-VX54-5PMF Incorrect validation of parties IDs leaks secret keys in Secret-sharing scheme

Summary In the threshold signature scheme, participants start by dividing secrets into shares using a secret sharing scheme. The Verifiable Secret Sharing scheme generates shares from the user’s IDs but does not properly validate them. Using a malicious ID will make other users reveal their secre...

Malicious code in lib-bb-html-sanitizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 74072bddc9908e0147976fde0680c197ac5b38167bfcdf14afc5f79f23749f72 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

ROS-2-2201

2.2201 Denial of Service in libX11CVE-2021-31535 1. Vulnerability Description: The vulnerability allows a local user to execute a denial of service DoS attack. The vulnerability exists due to insufficient validation of color names in the XLookupColor function. A local user can launch a specially...

Nodejs Command Injection Vulnerability

nodejs is a JavaScript runtime environment based on the ChromeV8 engine through the Chromev8 engine for the packaging and the use of event-driven and non-blocking IO applications so that the development of high-performance Javascript background applications has become possible . A command injecti...

CVE-2021-45470

lib/DatabaseLayer.py in cve-search before 4.1.0 allows regular expression injection, which can lead to ReDoS regular expression denial of service or other impacts...

CVE-2021-45459

lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter...

CVE-2021-45459: Improper Neutralization of Special Elements used in a Command

lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter...

PT-2021-24240

Name of the Vulnerable Software and Affected Versions: node-windows versions prior to 1.0.0-beta.6 Description: The issue allows command injection via the PID parameter in the lib/cmd.js file of the node-windows package for Node.js. Recommendations: For versions prior to 1.0.0-beta.6, update to...