USN-5371-2 nginx vulnerability

USN-5371-1 fixed several vulnerabilities in nginx. This update provides the fix for CVE-2021-3618 for Ubuntu 22.04 LTS. Original advisory details: It was discovered that nginx Lua module mishandled certain inputs. An attacker could possibly use this issue to perform an HTTP Request Smuggling...

Adobe Acrobat Reader DC Collab Object Use-After-Free Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within th...

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software IPsec IKEv2 VPN Information Disclosure Vulnerability

A vulnerability in an IPsec VPN library of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to read or modify data within an IPsec IKEv2 VPN tunnel. This vulnerability is due to an improper implementatio...

Google Chromium 输入验证错误漏洞

Google Chromium is an open source web browser from Google, Inc. Google Chromium suffers from an input validation error vulnerability that could lead to the execution of arbitrary code, denial of service, or information disclosure...

The vulnerability of the Libraries component of Java SE software platforms, specifically the Oracle GraalVM Enterprise Edition virtual machine, allows attackers to disclose protected information.

The vulnerability of the Libraries component in Java SE software platforms, specifically within the Oracle GraalVM Enterprise Edition virtual machine, is related to insufficient protection of sensitive data. Exploiting this vulnerability can allow an attacker to disclose protected information...

The vulnerability of the Alac decoder in Microprogramming Software Microchip MediaTek MT6570, MT6580, MT6735, MT6737, MT6739, MT6750, MT6750S, MT6753, MT6755, MT6755S, MT6757, MT6757C, MT6757CD, MT6757CH, MT6758, MT6761, MT6763, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6797, MT6799, MT6833, MT6853, MT6853T, MT6873, MT6877, MT6883, MT6885, MT6889, MT6893, MT8163, MT8167, MT8167S, MT8168, MT8173, MT8175, MT8176, MT8183, MT8185, MT8195, MT8321, MT8362A, MT8365, MT8385, MT8765, MT8766, MT8768, MT8786, MT8788, MT8789, MT8791, MT8797—allows a hacker to disclose protected information.

The vulnerability of the Alac decoder in microprogramming software for MediaTek’s MT6570, MT6580, MT6735, MT6737, MT6739, MT6750, MT6750S, MT6753, MT6755, MT6755S, MT6757, MT6757C, MT6757CD, MT6757CH, MT6758, MT6761, MT6763, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6797, MT6799, MT6833,...

The vulnerability of the Adobe Animate software for creating multimedia and computer animations lies in the ability to read data beyond the buffer in memory, allowing attackers to exploit this to disclose protected information.

The vulnerability of the Adobe Animate program for creating multimedia and computer animations is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to disclose protected information within the context of the current user, using a specially...

The vulnerability of the Juniper Networks Contrail Service Orchestration software lies in a failure of the protection mechanism in the REST API, which allows an attacker to disclose protected information.

The vulnerability of the Juniper Networks Contrail Service Orchestration software is related to a failure in the protection mechanism of the REST API. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose the protected information...

The vulnerability of the CGI interpreter component for the PHP programming language allows attackers to disclose protected information, compromise data integrity, or cause service failures.

The vulnerability of the cgi component sapi/cgi/cgimain.c in the PHP programming language is caused by buffer overflow. Exploiting this vulnerability can allow an attacker to disclose sensitive information, compromise data integrity, or cause service failures...

The vulnerability of the ext/shmop/shmop.c component of the PHP programming language interpreter allows a attacker to cause a service failure or disclose protected information.

The vulnerability of the ext/shmop/shmop.c component of the PHP programming language interpreter is related to errors in number processing. Exploiting this vulnerability can allow an attacker to cause service failures or disclose sensitive information...

The vulnerability of the History API component in the Cisco SD-WAN vManage network management system allows a attacker to disclose protected information.

The vulnerability of the History API component in the Cisco SD-WAN vManage network management system is related to errors in request processing. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

The vulnerability of the `make_http_soap_request` function in the PHP programming language allows a attacker to trigger a service failure or disclose protected information.

The vulnerability of the makehttpsoaprequest function in the PHP programming language exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service failures or expose sensitive information through serialized data like cookies...

The vulnerability of the sapi/fpm/fpm/fpm_log.c component, a PHP programming language interpreter, allows an attacker to disclose protected information or cause service failures.

The vulnerability of the sapi/fpm/fpm/fpmlog.c component, a PHP programming language interpreter, is caused by buffer overflow. Exploiting this vulnerability can allow an attacker to disclose sensitive information or cause service failures...

UBUNTU-CVE-2022-1451

Out-of-bounds Read in rbinjavaconstantvalueattrnew function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a...

Oracle PeopleSoft Enterprise PeopleTools Information Disclosure Vulnerability (CNVD-2023-12017)

Oracle Corporation Oracle is the world's largest provider of information management software and services, founded in 1977, headquartered in Redwood shore, California, USA, open to the world oracle certification. Oracle PeopleSoft Enterprise PeopleTools is the American Oracle Oracle company's...

The vulnerability of the exif_process_ifd_in_makernote function (ext/exif/exif.c) in the PHP programming language allows a attacker to cause a service failure, disclose protected information, or potentially have other adverse effects.

The vulnerability of the exifprocessifdinmakernote function ext/exif/exif.c in the PHP programming language is caused by buffer overflow. Exploiting this vulnerability could allow a remote attacker to cause service failures, disclose sensitive information, or potentially have other adverse effect...

The vulnerability of Cisco Webex Meetings’ software web interface stems from the lack of protective measures for the website structure. This allows attackers to disclose protected information, alter the appearance of the website, and perform phishing attacks as well as “drive-by” attacks.

The vulnerability of Cisco Webex Meetings’ software web interface exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to disclose protected information, alter the appearance of the website, and perform phishing attacks ...

The vulnerability in the web interface of the Cisco Identity Services Engine, which allows a perpetrator to disclose protected information

The vulnerability of the Cisco Identity Services Engine’s network policy management web interface is related to the improper assignment of privileges. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

Elcomplus SmartPPT 跨站请求伪造漏洞

Elcomplus SmartPPT is an integrated voice and data scheduling software from Elcomplus USA. Elcomplus SmartPPT suffers from a cross-site request forgery vulnerability that stems from a web application that cannot or does not adequately verify that a user submitting a request has intentionally...

The vulnerability of the MLoadTypedArrayElementHole component in web browsers such as Firefox, Firefox ESR, and the email client Thunderbird allows an attacker to disclose protected information.

The vulnerability of the MLoadTypedArrayElementHole component in Firefox web browsers, Firefox ESR, and the email client Thunderbird is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information...