OTFCC Heap Buffer Overflow Vulnerability (CNVD-2023-10598)

OTFCC is Caryll open source a C library and utility programs. Used to parse and write OpenType font files. OTFCC suffers from a heap buffer overflow vulnerability that originates from a boundary error in /release-x64/otfccdump+0x6b05aa when handling untrusted input. An attacker could exploit the...

Oracle Database Server 跨站脚本漏洞

Oracle Database Server is a set of relational database management system of the United States Oracle Oracle. This database management system provides data management, distributed processing and other functions. A cross-site scripting vulnerability exists in Oracle Database Server version 19c. An...

CVE-2022-21595

Vulnerability in the MySQL Server product of Oracle MySQL component: C API. Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

OTFCC Buffer Overflow Vulnerability (CNVD-2023-11777)

OTFCC is a C library and utility open sourced by Caryll. It is used to parse and write OpenType font files.OTFCC 0.10.4 and earlier versions have a buffer overflow vulnerability that originates in /release-x64/otfccdump 0x6b0b2c with a boundary error when processing untrusted input, which can be...

CVE-2022-3594 Linux Kernel BPF r8152.c intr_callback logging of excessive data

A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intrcallback of the file drivers/net/usb/r8152.c of the component BPF. The manipulation leads to logging of excessive data. The attack can be launched remotely. It is...

CVE-2022-21595

CVE-2022-21595 affects Oracle MySQL Server (component: C API). Affected versions include MySQL Server 5.7.36 and prior and 8.0.27 and prior. The vulnerability is exploitable with network access via multiple protocols and is described as difficult to exploit, requiring high privileges. Successful ...

CVE-2022-21595

Removed by vendor...

Important: Red Hat Security Advisory: compat-expat1 security update

An update for compat-expat1 is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

libxml2: Multiple Vulnerabilities

Background libxml2 is the XML C parser and toolkit developed for the GNOME project. Description Multiple vulnerabilities have been discovered in libxml2. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround The...

heap-buffer-overflow in function inc at misc2.c

Description heap-buffer-overflow in function inc at misc2.c:356:6 vim version shell git log commit ba43e76fcd5b2da57dbaa4d9a555793fe8ac344e HEAD - master, tag: v9.0.0747, origin/master, origin/HEAD Proof of Concept shell ./src/vim -u NONE -X -Z -e -s -S ./poc -c ':qa!'...

libxml2 输入验证错误漏洞

libxml2 is an open source library used to parse XML documents . It is written in C and can be called by many languages, such as C, C++, XSH. An input validation error vulnerability exists in libxml2. No information about this vulnerability is available at this time, please stay tuned to CNNVD or...

PT-2022-7027 · Softing · Softing Opc Ua C++ Sdk +1

Name of the Vulnerable Software and Affected Versions: Softing OPC UA C++ SDK versions affected versions not specified Softing Secure Integration Server versions affected versions not specified Description: The issue is related to the incorrect restriction of a directory path name with limited...

FUD-UUID-Shellcode - Another shellcode injection technique using C++ that attempts to bypass Windows Defender using XOR encryption sorcery and UUID strings madness

Introduction Another shellcode injection technique using C++ that attempts to bypass Windows Defender using XOR encryption sorcery and UUID strings madness :. How it works Shellcode generation Firstly, generate a payload in binary format using either CobaltStrike or msfvenom for instance, in...

Sensormatic Electronics C-CURE 9000 安全漏洞

Sensormatic Electronics C-CURE 9000 is an event security management system from Sensormatic Electronics. Monitor events and system activity, create reports, display dynamic views, view video, and manage people and guest applications anywhere in the world, directly from your PC. A security...

Sensormatic Electronics C-CURE 9000

1. EXECUTIVE SUMMARY CVSS v3 4.3 ATTENTION: Low attack complexity Vendor: Sensormatic Electronics, LLC, a subsidiary of Johnson Controls Inc. Equipment: C-CURE 9000 Vulnerability: Observable Response Discrepancy 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an...

Huawei EulerOS: Security Advisory for glibc (EulerOS-SA-2022-2501)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 36 Update: gitqlient-1.5.0-2.fc36

GitQlient, pronounced as git+client /g=EF=BF=BD=EF=BF=BDt=EF=BF=BD=EF=BF=BDk la=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BDnt/ is a multi-platform Git client originally forked from QGit. Nowadays it goes beyond of just a fork and adds a lot of new functionality. Some of the major feature you can find are...

Fedora: Security Advisory for expat (FEDORA-2022-15ec504440)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Cisco Expressway Series and Cisco TelePresence VCS Improper Certificate Validation Vulnerability (cisco-sa-expressway-csrf-sqpsSfY6)

According to its self-reported version, Cisco Expressway-C and Cisco TelePresence VCS devices are affected by a vulnerability in the certificate validation that could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data. The vulnerability is due to a lack of...

Buffer overflow

PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser are affeced by a buffer overflow vulnerability. Users connecting to untrusted clients are at risk. This issue has been...