7568 matches found
Memory corruption
A vulnerability has been identified in EN100 Ethernet module DNP3 IP variant All versions, EN100 Ethernet module IEC 104 variant All versions, EN100 Ethernet module IEC 61850 variant All versions V4.40, EN100 Ethernet module Modbus TCP variant All versions, EN100 Ethernet module PROFINET IO varia...
CVE-2022-30938
A vulnerability has been identified in EN100 Ethernet module DNP3 IP variant All versions, EN100 Ethernet module IEC 104 variant All versions, EN100 Ethernet module IEC 61850 variant All versions V4.40, EN100 Ethernet module Modbus TCP variant All versions, EN100 Ethernet module PROFINET IO varia...
PT-2022-20220
Name of the Vulnerable Software and Affected Versions Go versions prior to 1.17.12 Go versions prior to 1.18.4 Description The issue is related to uncontrolled recursion in Glob in io/fs, which allows an attacker to cause a panic due to stack exhaustion. This can be achieved by providing a path...
Siemens EN100 Ethernet Module
1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: EN100 Ethernet Module Vulnerability: Improper Restriction of Operations within the Bounds of a Memory Buffer. 2. RISK EVALUATION Successful exploitation of this vulnerability could...
go -- multiple vulnerabilities
The Go project reports: net/http: improper sanitization of Transfer-Encoding header The HTTP/1 client accepted some invalid Transfer-Encoding headers as indicating a "chunked" encoding. This could potentially allow for request smuggling, but only if combined with an intermediate server that also...
DEBIAN-CVE-2022-35414
softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translatefail path, leading to an ioreadx or iowritex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use ca...
CVE-2022-35414
softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translatefail path, leading to an ioreadx or iowritex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use ca...
AZL-10110 CVE-2022-35414 affecting package qemu for versions less than 6.2.0-7
softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translatefail path, leading to an ioreadx or iowritex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use ca...
NULL Pointer Dereference
Overview Affected versions of this package are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format. Remediation Upgrade io.socket:socket.io-client to version 2.0.1 or higher. References - GitHub Commit - GitHub Commit - GitHub Issue - GitHub Release Credi...
PT-2022-7346 · Linux +1 · Linux Kernel +1
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A NULL pointer dereference issue was discovered in the Linux kernel in io files update with index alloc. This issue could allow a local user to potentially crash the system, causing a...
Malicious code in skyscanner.github.io (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 562fc699118e25f03d6d6a536e7fc3223d2afc25b8f930b3c473541a554652a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Denial Of Service (DoS)
Jetty-IO is vulnerable to denial of service. The vulnerability exists because the buffer utilization of SslConnection is not properly handled which allows an attacker to cause a memory leak leading to an application crash...
Fedora: Security Advisory for golang-github-nats-io-streaming-server (FEDORA-2022-fae3ecee19)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Fedora: Security Advisory for golang-github-nats-io-nkeys (FEDORA-2022-fae3ecee19)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Fedora: Security Advisory for golang-github-etcd-io-gofail (FEDORA-2022-fae3ecee19)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Malicious code in io-components (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af254b2a53bba08ba0b4ae7258357e2ef8a08a663eb4fb07a19b331753ef234e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-3924 Malicious code in io-components (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af254b2a53bba08ba0b4ae7258357e2ef8a08a663eb4fb07a19b331753ef234e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview io-components is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...
GO-2022-0386 Import token permissions checking not enforced in github.com/nats-io/jwt
Import tokens valid for one account may be used for any other account. Validation of Import token bindings incorrectly warns on mismatches, rather than rejecting the Goken. This permits a token for one account to be used for any other account...
PT-2022-4808 · Linux +5 · Linux Kernel +5
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a use-after-free in io uring in the Linux kernel. The Signalfd poll and binder poll functions use a waitqueue whose lifetime is the current task, and it sends a...