7562 matches found
chantdemonpays.qc.ca Cross Site Scripting vulnerability OBB-2418740
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
ColdFusion verifyldapserver vulnerability
Added: 03/07/2022 Background Adobe ColdFusion is a web application development platform written in Java. Problem The verifyldapserver method in utils.cfc allows a remote attacker to cause the server to download a Java class from an arbitrary LDAP server, leading to remote code execution. Resoluti...
Kunze Law < 2.1 - Admin+ Stored Cross-Site Scripting
The plugin does not escape its 'E-Mail Error "From" Address' settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Put the following payload in the 'E-Mail Error "From" Address' settings of the plugi...
CLSA-2022-1644855795 Fixed CVEs in vim: CVE-2022-0359, CVE-2022-0351, CVE-2022-0368, CVE-2022-0361
CVE-2022-0351: fix crash caused by too depth recursion - CVE-2022-0359: fix illegal memory access with large tabstop in ex mode - CVE-2022-0361: fix illegal memory access when copying lines in visual mode - CVE-2022-0368: fix illegal memory access when undo makes visual area invalid...
PT-2022-7469
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The vulnerability is related to an information leak in the swiotlb component of the Linux kernel, which can occur when using DMA FROM DEVICE. The issue arises when a TEST UNIT READY...
PT-2022-36830
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow read issue was identified, potentially causing a crash. The crash occurred in the parse primitive function, which is part of the pli...
CVE-2022-0562
Null source pointer passed as an argument to memcpy function within TIFFReadDirectory in tifdirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c...
Iranian state-sponsored APT group MuddyWater targeting organizations via malicious executables
THREAT LEVEL: Red. United States Cyber Command USCYBERCOM has warned of an ongoing cyber attack by Iranian state sponsored actor named as MuddyWater. This APT group is currently targeting Middle Eastern countries and has also targeted European and North American nations. The Iranian-backed...
CVE-2021-46445
creationtimestamp| type| source ---|---|--- 2022-01-29 00:22:31+00:00| seen| https://t.me/cibsecurity/36536...
Mageia: Security Advisory (MGASA-2021-0462)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PT-2022-37294
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read error. The crash state indicates the involvement of functions such as strtol, parse primitive, and plis...
CVE-2021-41835
Fresenius Kabi Agilia Link + version 3.0 does not enforce transport layer encryption. Therefore, transmitted data may be sent in cleartext. Transport layer encryption is offered on Port TCP/443, but the affected service does not perform an automated redirect from the unencrypted service on Port...
PT-2022-12653
Name of the Vulnerable Software and Affected Versions JerryScript version 3.0.0 Description The issue is related to an assertion failure in the ecma new ecma string from utf8 function at /base/ecma-helpers-string.c in JerryScript. The assertion lit is valid cesu8 string string p, string size fail...
CVE-2021-39683
In copyfrommbox of sssiceutil.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:...
PT-2022-10968
Name of the Vulnerable Software and Affected Versions Android kernel Description The issue is related to a possible out of bounds write in the copy from mbox function of sss ice util.c due to a missing bounds check. This could lead to local escalation of privilege, requiring System execution...
PT-2022-36988
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A crash occurred due to a segmentation fault on an unknown address. The crash state includes functions such as zero, zend execute, and fuzzer do request fr...
the first depositor to a pool can drain all users
Handle danb Vulnerability details if there is no liquidity in the pool, the first deposit determines the total liquidity, if the amount is too small the minted liquidity for the next liquidity providers will round down to zero. Impact An attacker can steal all money from liquidity providers. Proo...
PT-2022-1469
Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions prior to 18.4R2-S9, 18.4R3-S9 Juniper Networks Junos OS 19.1 versions prior to 19.1R2-S3, 19.1R3-S7 Juniper Networks Junos OS 19.2 versions prior to 19.2R1-S7, 19.2R3-S3 Juniper Networks Junos OS 19.3 version...
CVE-2021-32998
The FANUC R-30iA and R-30iB series controllers are vulnerable to an out-of-bounds write, which may allow an attacker to remotely execute arbitrary code. INIT START/restore from backup required...
