CVE-2022-46662

Roxio Creator LJB starts another program with an unquoted file path. Since a registered Windows service path contains spaces and are unquoted, if a malicious executable is placed on a certain path, the executable may be executed with the privilege of the Windows service. The affected product and...

JVN#13075438: Corel Roxio Creator LJB starts a program with an unquoted file path

Roxio Creator LJB provided by Corel Corporation starts another program with an unquoted file path CWE-428. Impact Since a registered Windows service path contains spaces and are unquoted, if a malicious executable is placed on a certain path, the executable may be executed with the privilege of t...

Corel Roxio Creator LJB code-related vulnerabilities

Corel Roxio Creator LJB is a CD/DVD burning software application from Corel Digital Technology Corel Canada. It makes capturing and converting media easy. A security vulnerability exists in Corel Roxio Creator LJB that originates when the supplied Roxio Creator LJB launches another program with a...

CVE-2022-46875

The Mozilla Foundation Security Advisory describes this flaw as: The executable file warning was not presented when downloading .atloc and .ftploc files, which can run commands on a user's computer. Note: This issue only affected Mac OS operating systems. Other operating systems are unaffected...

Slackware Linux 15.0 mozilla-firefox Multiple Vulnerabilities (SSA:2022-348-01)

The version of mozilla-firefox installed on the remote host is prior to 102.6.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-348-01 advisory. - An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary file...

Siemens Simcenter STAR-CCM Privilege Elevation Vulnerability

Siemens Simcenter STAR-CCM is a complete multi-physics field solution from Siemens Germany that simulates products and designs working under real-world conditions. a security vulnerability exists in Siemens Simcenter STAR-CCM, which stems from improperly assigning file permissions to installation...

EXEMSI MSI Wrapper security vulnerability

EXEMSI MSI Wrapper is a tool from EXEMSI Inc. can easily convert executable installers into MSI packages. A security vulnerability exists in EXEMSI MSI Wrapper versions 6.0.91 through 10.0.50, which can be exploited by an attacker to introduce a local privilege escalation into the installer it...

Mozilla Firefox < 108.0

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 108.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-51 advisory. - Mozilla developers and community members Lukas Bernhard, Gabriele Svelto, Randell Jesup, and the Mozilla...

Mozilla Firefox ESR < 102.6

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 102.6. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-52 advisory. - A use-after-free in WebGL extensions could have led to a potentially exploitable crash. CVE-2022-46882 -...

CVE-2022-4223

CVE-2022-4223 describes a remote code execution vulnerability in pgAdmin that affects versions prior to 6.17. An insecure HTTP API allows an unauthenticated user to pass a manipulated path (e.g., a UNC path) to the server, which could lead to the execution of an arbitrary executable on the pgAdmi...

Security Vulnerabilities fixed in Thunderbird 102.6 — Mozilla

A missing check related to tex units could have led to a use-after-free and potentially exploitable crash. An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages.This bug only affects Thunderbird for Linux...

PT-2022-27998

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 108 Firefox ESR versions prior to 102.6 Thunderbird versions prior to 102.6 Description The issue allows executable files, such as .atloc and .ftploc, to be downloaded without presenting a warning, potentially enablin...

Mozilla Firefox security vulnerabilities

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox that originates from a failure to display an executable warning when downloading .atloc and .ftploc files, which can run commands on a user's computer...

Mozilla Firefox injection vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from an injection vulnerability that stems from a failure to execute the Unsafe-Hashes CSP directive. An attacker could exploit this vulnerability to inject executable script...

DesignReview.exe Code Execution

The vulnerability of the implementation of the executable file DesignReview.exe of the Autodesk Design Review software for applying electronic annotations is related to writing beyond the buffer boundaries during the processing of .dwf or .pct format files. Exploiting this vulnerability can allow...

SUSE-SU-2022:4277-1 Security update for binutils

This update for binutils fixes the following issues: The following security bugs were fixed: - CVE-2019-1010204: Fixed out-of-bounds read in elfcpp/elfcppfile.h bsc1142579. - CVE-2021-3530: Fixed stack-based buffer overflow in demanglepath in rust-demangle.c bsc1185597. - CVE-2021-3648: Fixed...

AVEVA Edge SCADA stadosvr.exe Code Execution

The vulnerability of the stadosvr.exe executable file in the AVEVA Edge SCADA system is related to errors in access control. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

CVE-2022-41924 Tailscale Windows daemon is vulnerable to RCE via CSRF

A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon tailscaled, which can then be used to remotely execute code. In the Tailscale Windows client, the local API was bound to a local TCP socket, and communicated with the Windows...

PT-2022-5603 · Aveva · Aveva Edge

Name of the Vulnerable Software and Affected Versions: AVEVA Edge formerly InduSoft Web Studio versions R2020 and prior Description: An issue was discovered in the ExecuteCommand function that allows unauthenticated arbitrary commands to be executed. This is related to errors in access control...

SUSE: Security Advisory (SUSE-SU-2022:4146-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...