5631 matches found
webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution
A use-after-free vulnerability was found in WebKitGTK. The vulnerability occurs when processing HTML content in WebKit. This flaw allows a remote attacker to trick the victim into opening a specially crafted web page, trigger a use-after-free error and execute arbitrary code on the system...
webkitgtk: maliciously crafted web content may lead to arbitrary code execution due to use after free
A use-after-free vulnerability was found in WebKitGTK. The vulnerability occurs when processing HTML content in WebKit. This flaw allows a remote attacker to trick the victim into opening a specially crafted web page, triggering a use-after-free error and leading to the execution of arbitrary cod...
CVE-2022-29491
On F5 BIG-IP LTM, Advanced WAF, ASM, or APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and all versions of 13.1.x, 12.1.x, and 11.6.x, when a virtual server is configured with HTTP, TCP on one side client/server, and DTLS on the other...
CVE-2022-0649
The AdRotate WordPress plugin before 5.8.23 does not escape Group Names, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
CVE-2022-29816
In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible...
Jetbrains IntelliJ IDEA code injection vulnerability
JetBrains IntelliJ IDEA is a suite of integrated development environments for the Java language from Jetbrains Czech Republic.JetBrains IntelliJ IDEA versions prior to 2022.1 contain a code injection vulnerability that could be exploited to execute native code via HTML descriptions in custom JSON...
CVE-2022-22275
Improper Restriction of TCP Communication Channel in HTTP/S inbound traffic from WAN to DMZ bypassing security policy until TCP handshake potentially resulting in Denial of Service DoS attack if a target host is vulnerable...
Exif Extension DoS
The vulnerability of the Exif extension in the PHP programming language interpreter arises due to buffer overflow. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures...
Fortinet FortiWLM Command Injection Code Execution
The vulnerability of Fortinet FortiWLM’s WLAN access point and LAN switch management systems exists due to the failure to take measures to neutralize special elements used in the operating system command. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a...
PHP spl_array Heap Buffer Overflow DoS
The vulnerability of the ext/spl/splarray.c component of the PHP interpreter exists due to insufficient checking of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures or potentially have other adverse effects using specially created serialized data...
PHP OpenSSL DoS
The vulnerability of the openssl extension ext/openssl/openssl.c in the PHP programming language interpreter is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability could allow a malicious actor to cause service failures...
CVE-2022-21497
Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware component: Web Services Security. Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...
CVE-2022-21447
Vulnerability in the PeopleSoft Enterprise CS Academic Advisement product of Oracle PeopleSoft component: Advising Notes. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...
CVE-2022-21421
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware component: Analytics Web General. Supported versions that are affected are 5.5.0.0.0, 5.9.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker wit...
HTTP Request Smuggling in twisted.web
...
Fortinet FortiWLM Command Injection
The vulnerability of Fortinet FortiWLM’s WLAN access point and LAN switch centralized management system exists due to the failure to take measures to neutralize special elements used in the operating system command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary...
Mediation Engine Privilege Escalation
The vulnerability of the Mediation Engine component of the Oracle Communications Operations Monitor visualization and monitoring system exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain read access to data o...
Intelligence component Access Modification
The vulnerability of the Intelligence component of the Oracle Sourcing supply management platform’s RFx Creation platform is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to gain read, modify, add, or delete access to data using the HTTP...
envoy: Use-after-free when tunneling TCP over HTTP
A flaw was found in envoy. If a downstream source disconnects during upstream connection establishment when tunneling TCP over HTTP, a use-after-free can occur, resulting in a denial of service...