CVE-2022-39199 Lack of proper validation in immudb

immudb is a database with built-in cryptographic proof and verification. immudb client SDKs use server's UUID to distinguish between different server instance so that the client can connect to different immudb instances and keep the state for multiple servers. SDK does not validate this uuid and...

CVE-2022-28766 DLL injection in Zoom Windows Clients

Windows 32-bit versions of the Zoom Client for Meetings before 5.12.6 and Zoom Rooms for Conference Room before version 5.12.6 are susceptible to a DLL injection vulnerability. A local low-privileged user could exploit this vulnerability to run arbitrary code in the context of the Zoom client...

CVE-2022-28764 Local information exposure in Zoom Clients

The Zoom Client for Meetings for Android, iOS, Linux, macOS, and Windows before version 5.12.6 is susceptible to a local information exposure vulnerability. A failure to clear data from a local SQL database after a meeting ends and the usage of an insufficiently secure per-device key encrypting...

CVE-2021-44862 Sensitive Information store in NSClient logs

Netskope client is impacted by a vulnerability where an authenticated, local attacker can view sensitive information stored in NSClient logs which should be restricted. The vulnerability exists because the sensitive information is not masked/scrubbed before writing in the logs. A malicious user c...

MGASA-2022-0382 Updated epiphany packages fix security vulnerability

In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow in ephystringshorten in the UI process via a long page title. The issue occurs because the number of bytes for a UTF-8 ellipsis character is not properly considered. CVE-2022-29536...

TP-LINK AX10 信任管理问题漏洞

The TP-LINK AX10 is a router from China P&L TP-LINK. A security vulnerability exists in the TP-LINK AX10 version V12111117, which originates from the use of hard-coded encryption keys by web application clients when communicating with the router. An attacker could use this vulnerability to obtain...

Microsoft Windows Point-to-Point Tunneling Protocol 竞争条件问题漏洞

Microsoft Windows Point-to-Point Tunneling Protocol PPTP is a network protocol from Microsoft that enables the secure transmission of data from remote clients to private corporate servers by creating a virtual private network VPN over a TCP/IP-based data network. VPN. A competitive conditions iss...

Microsoft Windows DHCP Client 安全漏洞

Microsoft Windows is a set of operating systems for personal devices from Microsoft Corporation USA.An elevation of privilege vulnerability exists in Microsoft Windows DHCP Client, which stems from improper privilege assignment in the application and can be exploited by an attacker to cause an...

CVE-2022-23678

A vulnerability in the Aruba Virtual Intranet Access VIA client for Microsoft Windows operating system client communications that could allow for an attacker in a privileged network position to intercept sensitive information in Aruba Virtual Intranet Access VIA client for Microsoft Windows...

CVE-2021-44718

wolfSSL through 5.0.0 allows an attacker to cause a denial of service and infinite loop in the client component by sending crafted traffic from a Machine-in-the-Middle MITM position. The root cause is that the client module accepts TLS messages that normally are only sent to TLS servers...

AZL-10529 CVE-2022-1705 affecting package golang for versions less than 1.18.5-1

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid...

IBM Spectrum Protect 安全漏洞

IBM Spectrum Protect is a suite of data protection platforms from IBM USA. The platform provides enterprises with a single point of control and management, and supports backup and recovery for virtual, physical and cloud environments of all sizes. IBM Spectrum Protect Client has an information...

The vulnerability of clients for conducting real-time audio and video conferences via Zoom Client for Meetings on Android, iOS, Linux, macOS, and Windows allows a perpetrator to disclose protected information.

The vulnerability of clients for conducting real-time audio and video conferences using Zoom Client for Meetings on Android, iOS, Linux, macOS, and Windows involves the disclosure of information. Exploiting this vulnerability can allow a malicious actor to disclose the protected information...

CVE-2021-3779

A malicious MySQL server can request local file content from a client using ruby-mysql prior to version 2.10.0 without explicit authorization from the user. This issue was resolved in version 2.10.0 and later...

google-oauth-client: Token signature not verified

A flaw was found in Google OAuth Java client's IDToken verifier, where it does not verify if the token is properly signed. This issue could allow an attacker to provide a compromised token with a custom payload that will pass the validation on the client side, allowing access to information outsi...

CVE-2022-31031 Potential stack buffer overflow when parsing message as a STUN client

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions prior to and including 2.12.1 a stack buffer overflow vulnerability affects PJSIP users that use STUN in their...

ai.h2o:sparkling-water-core_2.11 (>=3.32.0.1-2-2.1 <=3.36.0.2-1-2.4), ai.h2o:sparkling-water-doc_2.11 (>=3.34.0.3-1-2.2 <=3.36.0.2-1-2.4) +251 more potentially affected by CVE-2021-20218 via io.fabric8:kubernetes-client (>=4.2.0 <=4.7.1)

io.fabric8:kubernetes-client MAVEN version =4.2.0, =3.32.0.1-2-2.1, =3.34.0.3-1-2.2, =3.34.0.3-1-2.2, =3.34.0.3-1-2.2, =0.0.1, =1.9.51, =1.1.1, =7.4.1, =7.4.1play2.6, =23.1.0play2.7, =0.0.1, =0.0.1, =0.3.6, =0.2.0, =0.2.0, =0.3.9 and more Source cves: CVE-2021-20218 Source advisory: OSV:GHSA-JWH...

ai.h2o:sparkling-water-core_2.12 (>=3.32.1.2-1-3.1 <=3.36.0.2-1-3.1), ai.h2o:sparkling-water-doc_2.12 (>=3.34.0.3-1-3.1 <=3.36.0.2-1-3.1) +124 more potentially affected by CVE-2021-20218 via io.fabric8:kubernetes-client (>=4.12.0 <=4.13.1)

io.fabric8:kubernetes-client MAVEN version =4.12.0, =3.32.1.2-1-3.1, =3.34.0.3-1-3.1, =3.34.0.3-1-3.1, =3.34.0.3-1-3.1, =2.1.0, =2.7.0, =3.2.0, =2.17.1, =0.0.1, =0.0.12, =0.0.4, =0.0.3, =0.0.1, =1.0.2 and more Source cves: CVE-2021-20218 Source advisory: OSV:GHSA-JWH2-FFG4-48XC...

GHSA-JF99-2RJ4-JXRM Transifex command-line client has improper certificate validation

Transifex command-line client before 0.10 does not validate X.509 certificates for data transfer connections, which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2073...

The vulnerability of the AWS VPN Client service, related to the disclosure of information, allows a perpetrator to expose the protected information.

The vulnerability of the AWS VPN Client relates to the exposure of information. Exploiting this vulnerability could allow a malicious actor to disclose protected information using a specially created malicious configuration file named ovpn...