PT-2022-36728 · Spvtools · Spvtools

Name of the Vulnerable Software and Affected Versions: spvtools affected versions not specified Description: The issue is related to a crash caused by a container-overflow read. Technical details about the crash include the CanMergeWithSuccessor function and the BlockMergePass::Process function...

PT-2025-18635

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability has been resolved in the Linux kernel. The issue occurs during the initialization of ip vs conn net init, where if the file ip vs conn or ip vs conn sync fails to be...

ProcessWire: Cross-site scripting vulnerabilities

ProcessWire is a friendly and powerful open source CMS with a robust API. A cross-site scripting vulnerability exists in ProcessWire version v3.0.200, which originates from the Search Users and Search Functions pages and allows attackers to execute arbitrary web script or HTML by injecting a...

PT-2022-25403 · Unknown · Processwire

Name of the Vulnerable Software and Affected Versions: ProcessWire version 3.0.200 Description: The issue allows attackers to execute arbitrary web scripts or HTML via injection of a crafted payload, leveraging multiple cross-site scripting XSS vulnerabilities. These vulnerabilities are...

Google Chrome Microsoft Edge Information Disclosure

The vulnerability of the browser import function implementations in Google Chrome and Microsoft Edge is related to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information through a specially created web page...

PT-2022-36732 · Libraw · Libraw

Name of the Vulnerable Software and Affected Versions: LibRaw affected versions not specified Description: The issue is related to a heap-buffer-overflow read error. Technical details about the crash include the LibRaw::phase one correct, LibRaw::raw2image ex, and LibRaw::dcraw process functions...

[SECURITY] [DSA 5267-1] pysha3 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5267-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 30, 2022 https://www.debian.org/security/faq -...

PT-2022-36727 · Oracle · Java

Name of the Vulnerable Software and Affected Versions: Java affected versions not specified Description: A security exception occurs due to a crash in the Double.parseDouble function, which is called by FloatingDecimal.readJavaFormatString and FloatingDecimal.parseDouble. Recommendations: At the...

PT-2022-36718 · Libraw · Libraw

Name of the Vulnerable Software and Affected Versions: LibRaw affected versions not specified Description: The issue is related to a heap buffer overflow, which occurs when writing data. The crash is associated with the kodak rgb load raw, kodak thumb loader, and unpack thumb functions in LibRaw...

PT-2022-36724 · Git +1 · Wireshark

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ crash occurred, involving the functions wmem strbuf append vprintf and wmem strbuf append printf, which are called by dissect...

performance.getEntries() Bypass Unauthorized Access

The vulnerability of the performance.getEntries method in Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to the inclusion of functions from an unverified controlled area. Exploiting this vulnerability could allow a remote attacker to obtain URL records from various...

PT-2022-36711 · Git +1 · Openexr

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read, as indicated by an OSS-Fuzz report. The crash state involves several functions: fasthuf initialize,...

CVE-2022-2421

Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object...

PT-2022-36710 · Git +1 · Ghostscript

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type identified as Stack-use-after-return READ 4. The crash state involves several functions, including gs type2 interpre...

Delta Electronics InfraSuite Device Master Access Control Vulnerability

Delta Electronics InfraSuite Device Master is used to simplify and automate the monitoring of critical devices by Delta Electronics of Taiwan, China. The Delta Electronics InfraSuite Device Master suffers from an access control error vulnerability that stems from deserialization of untrusted data...

CVE-2022-33185

Several commands in Brocade Fabric OS before Brocade Fabric OS v.9.0.1e, and v9.1.0 use unsafe string functions to process user input. Authenticated local attackers could abuse these vulnerabilities to exploit stack-based buffer overflows, allowing arbitrary code execution as the root user accoun...

22-Year-Old Vulnerability Reported in Widely Used SQLite Database Library

A high-severity vulnerability has been disclosed in the SQLite database library, which was introduced as part of a code change dating all the way back to October 2000 and could enable attackers to crash or control programs. Tracked as CVE-2022-35737 CVSS score: 7.5, the 22-year-old issue affects...

CVE-2022-2421 Socket.io - Improper type validation in attachment parsing

Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object...

PT-2022-36704 · Git +1 · Clamav

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of UNKNOWN READ. The crash state involves several functions: cli ole2 extract, cli scanole2, and cli magic scan. No...

Amazon Linux 2 : golang-github-gorilla-mux (ALAS-2022-1860)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1860 advisory. 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this advisory. A flaw was found in golang. The HTTP/1 client accepted invalid...