PT-2022-36807 · Git +1 · Libredwg

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 1 crash has been reported. The crash involves the functions bit read B, dwg decode header variables, and decode R13 RNUMBER. ...

Implementing Security Restrictions and Owner Access Controls on LPDA Smart Contract.

Lines of code Vulnerability details Vulnerability details Impact The new changes to the contract add an additional layer of security and restrict access to certain privileged functions. The buy function now requires that only the owner can purchase tokens, which prevents malicious actors from...

io.quarkus:quarkus-amazon-lambda-http (1.3.4.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.3.4.final) +53 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (1.3.4.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.3.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.3.4.final -...

io.quarkus:quarkus-amazon-lambda-http (1.9.0.cr1), io.quarkus:quarkus-amazon-lambda-http-deployment (1.9.0.cr1) +72 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (1.9.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 1.9.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.9.0.cr1 - io.quarkus:quarkus-amazon-lambda-http-deploymen...

io.quarkus:quarkus-amazon-lambda-http (1.1.0.cr1), io.quarkus:quarkus-amazon-lambda-http-deployment (1.1.0.cr1) +51 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (1.1.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 1.1.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.1.0.cr1 - io.quarkus:quarkus-amazon-lambda-http-deploymen...

io.quarkus:quarkus-amazon-lambda-http (1.11.4.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.11.4.final) +174 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (1.11.4.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.11.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.11.4.final -...

io.quarkiverse.cxf:quarkus-cxf (0.1.1), io.quarkiverse.cxf:quarkus-cxf-deployment (0.1.1) +390 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (1.10.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.10.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.cxf:quarkus-cxf 0.1.1 - io.quarkiverse.cxf:quarkus-cxf-deployment 0.1.1 -...

io.quarkus:quarkus-amazon-lambda-http (1.10.1.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.10.1.final) +72 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (1.10.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.10.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.10.1.final -...

io.quarkus:quarkus-azure-functions-http (0.23.1), io.quarkus:quarkus-azure-functions-http-deployment (0.23.1) +38 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (0.23.1)

io.quarkus:quarkus-vertx-http MAVEN version 0.23.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-azure-functions-http 0.23.1 - io.quarkus:quarkus-azure-functions-http-deployment...

Privilege Escalation

github.com/clastix/capsule is vulnerable to privilege escalation. The vulnerability exists in the syncNamespaceMetadata function in namespaces.go because it can edit and remove the owner reference when granted patch capabilities on its namespace...

PT-2022-36803 · Git +1 · C-Blosc2

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ crash has been reported, involving the ZSTD createDDict, blosc run decompression with context, and blosc2 decompress ctx...

Exploit for Incorrect Permission Assignment for Critical Resource in Apache Cassandra

CVE-2021-44521 Automated PoC of CVE-2021-44521 Credits to orig...

PT-2022-36798 · Git +1 · Relic

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue is related to a crash caused by the use of an uninitialized value. The crash occurs in the following functions: bn trim, bn div dig, and bn size str. No information is availab...

Design/Logic Flaw

Insecure permissions in Telos Alliance Omnia MPX Node v1.0.0 to v1.4.9 allow attackers to manipulate and access system settings with backdoor account low privilege, this can lead to change hardware settings and execute arbitrary commands in vulnerable system functions that is requires high...

CVE-2022-3270 Incomplete Documentation of remote functions in FESTO products.

In multiple products by Festo a remote unauthenticated attacker could use functions of an undocumented protocol which could lead to a complete loss of confidentiality, integrity and availability...

APsystems Access Control Error Vulnerability

APsystems is a microinverter from APsystems, Inc. Combining high efficiency power conversion with a user-friendly monitoring interface, it brings you reliable and smart energy. An access control error vulnerability exists in APsystems ENERGY COMMUNICATION UNIT ECU-C Power Control Software version...

GNU Emacs Command Injection Vulnerability

GNU Emacs is a family of text editors from the GNU community in the U.S. A command injection vulnerability exists in GNU Emacs version 28.2 and earlier, which stems from lib-src/etags.c's use of system C library functions when implementing the ctags program. An attacker could exploit the...

Denial Of Service (DoS)

ImageMagick is vulnerable to denial of service DoS attacks. The vulnerability occurs due to improper use of open functions which allows remote attackers to cause denial of service conditions ultimately resulting in a system crash...

Festo Firmware

SUMMARY Incomplete Festo product documentation of remote accessible functions and their required IP ports. Depending on the product a description of the supported features can be found in the product documentation to some extent. Update A, 2022-12-13 Added affected device "Bus module CPX-E-PN,...

PT-2022-36793 · Git +1 · Ghostscript

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A crash has been reported with a type of UNKNOWN READ. The crash state includes functions such as chunk free object, ngx final DeviceN, and gs cspace...