3346 matches found
UBUNTU-CVE-2022-25638
In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs when the sigalgo field differs between the certificateverify message and the certificate message...
USN-5293-1 c3p0 vulnerability
Aaron Massey discovered that c3p0 could be made to crash when parsing certain input. An attacker able to modify the application's XML configuration file could cause a denial of service...
GHSA-M639-9WHG-FW97 Prototype Pollution in object-extend
The package object-extend from 0.0.0 through 0.5.0 is vulnerable to Prototype Pollution via object-extend...
CVE-2021-23702
The package object-extend from 0.0.0 are vulnerable to Prototype Pollution via object-extend...
UBUNTU-CVE-2021-43303
Buffer overflow in PJSUA API when calling pjsuacalldump. An attacker-controlled 'buffer' argument may cause a buffer overflow, since supplying an output buffer smaller than 128 characters may overflow the output buffer, regardless of the 'maxlen' argument supplied...
CVE-2021-44960
In SVGPP SVG++ library 1.3.0, the XMLDocument::getRoot function in the renderDocument function handled the XMLDocument object improperly, returning a null pointer in advance at the second if, resulting in a null pointer reference behind the renderDocument function...
GHSA-M744-2JJ8-VPFV Command injection in git-parse
The "gitDiff" function in Wayfair git-parse =1.0.4 has a command injection vulnerability. Clients of the git-parse library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability...
GHSA-G6WW-V8XP-VMWG Prototype pollution in pathval
A prototype pollution vulnerability affects all versions of package pathval under 1.1.1...
125softnlp (=0.0.1), a2 (>=0.10.11 <=0.10.13) +4847 more potentially affected by CVE-2022-21725 via tensorflow (>=1.0.1 <=2.5.2)
tensorflow PYPI version =1.0.1, =0.10.11, =0.1.0, =0.0.0, =0.6.0, =0.1.6, =1.0.0, =2.0.0, =1.0.0, =0.0.1, =0.0.7 and more Source cves: CVE-2022-21725 Source advisory: OSV:GHSA-V3F7-J968-4H5F...
The vulnerability of the basic Windows DWM library in the Windows operating system allows attackers to escalate their privileges.
The vulnerability of the Windows DWM base library in the Windows operating system is related to insecure management of privileges. Exploiting this vulnerability can allow an attacker to enhance their privileges...
The vulnerability of the logback logging library, related to deficiencies in the deserialization mechanism, allows attackers to execute arbitrary code.
The vulnerability of the logback logging library is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...
125softnlp (=0.0.1), a2 (>=0.10.11 <=0.10.13) +4847 more potentially affected by CVE-2022-21737 via tensorflow (>=1.0.1 <=2.5.2)
tensorflow PYPI version =1.0.1, =0.10.11, =0.1.0, =0.0.0, =0.6.0, =0.1.6, =1.0.0, =2.0.0, =1.0.0, =0.0.1, =0.0.7 and more Source cves: CVE-2022-21737 Source advisory: OSV:GHSA-F2VV-V9CG-QHH7...
CVE-2022-23254
Microsoft Power BI Information Disclosure Vulnerability...
CVE-2022-23252
Microsoft Office Information Disclosure Vulnerability...
CVE-2022-22715
Named Pipe File System Elevation of Privilege Vulnerability...
CVE-2022-22709
VP9 Video Extensions Remote Code Execution Vulnerability...
CVE-2022-21974
Roaming Security Rights Management Services Remote Code Execution Vulnerability...
CVE-2022-21971
Windows Runtime Remote Code Execution Vulnerability...
log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender
A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSAppender in Log4j 1.x is vulnerable to deserialization of untrusted data. This allows a remote attacker to execute code on the server if the deployed application is configured to use JMSAppender and to the attacker's JND...