CVE-2022-24903 Buffer overflow in TCP syslog server (receiver) components in rsyslog

Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used. This can result in a segfault or some other malfunction. As of our understanding, this vulnerability can not be used for remote code...

Apache Tomcat Directory Traversal

Directory traversal vulnerability in Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules modproxy, modrewrite, modjk, allows remote attackers to read arbitrary files via a .. dot dot sequence with combinations of 1 / slash, 2 \ backslash, and 3 URL-encoded backslash %...

GHSA-4PRH-GQW8-RGH5 Apache Tomcat Directory Traversal

Directory traversal vulnerability in Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules modproxy, modrewrite, modjk, allows remote attackers to read arbitrary files via a .. dot dot sequence with combinations of 1 / slash, 2 \ backslash, and 3 URL-encoded backslash %...

Cross-site scripting - DOM via view file function

Description In Modules - Files, when click a file will have a popup and in URL will append select-file= fragment, so this fragment in url lead to XSS-DOM. Proof of Concept...

org.keycloak:keycloak-saml-adapter-api-public (4.5.0.final), org.keycloak:keycloak-saml-adapter-core (4.5.0.final) +25 more potentially affected by CVE-2021-3827 via org.keycloak:keycloak-saml-core (4.5.0.final)

org.keycloak:keycloak-saml-core MAVEN version 4.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-core and may be impacted: - org.keycloak:keycloak-saml-adapter-api-public 4.5.0.final -...

org.keycloak:keycloak-dependencies-server-all (9.0.3), org.keycloak:keycloak-saml-adapter-api-public (9.0.3) +23 more potentially affected by CVE-2021-3827 via org.keycloak:keycloak-saml-core (9.0.3)

org.keycloak:keycloak-saml-core MAVEN version 9.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-core and may be impacted: - org.keycloak:keycloak-dependencies-server-all 9.0.3 - org.keycloak:keycloak-saml-adapter-api-publ...

org.keycloak:keycloak-dependencies-server-all (9.0.2), org.keycloak:keycloak-saml-adapter-api-public (9.0.2) +23 more potentially affected by CVE-2021-3827 via org.keycloak:keycloak-saml-core (9.0.2)

org.keycloak:keycloak-saml-core MAVEN version 9.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-core and may be impacted: - org.keycloak:keycloak-dependencies-server-all 9.0.2 - org.keycloak:keycloak-saml-adapter-api-publ...

org.keycloak:keycloak-saml-adapter-api-public (4.8.2.final), org.keycloak:keycloak-saml-adapter-core (4.8.2.final) +25 more potentially affected by CVE-2021-3827 via org.keycloak:keycloak-saml-core (4.8.2.final)

org.keycloak:keycloak-saml-core MAVEN version 4.8.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-core and may be impacted: - org.keycloak:keycloak-saml-adapter-api-public 4.8.2.final -...

Perl Interpreter Privilege Escalation

The vulnerability of modules from the @INC directory in the Perl interpreter is related to privilege management errors. Exploiting this vulnerability allows an attacker to execute arbitrary code using a Trojan virus program...

GSD-2022-1002015 ath11k: fix kernel panic during unload/load ath11k modules

ath11k: fix kernel panic during unload/load ath11k modules This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.111 by commit...

GSD-2022-1001075 ath11k: fix kernel panic during unload/load ath11k modules

ath11k: fix kernel panic during unload/load ath11k modules This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.3 by commit...

Security Bulletin: IBM QRadar Use Case Manager app is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. Vulnerability Details CVEID:CVE-2021-3807 DESCRIPTION: Chalk ansi-regex module for Node.js is vulnerable to a denial of service, caused by a regular expression...

SUSE-SU-2022:1164-1 Security update for go1.16

This update for go1.16 fixes the following issues: Update to version 1.16.15 bsc1182345: - CVE-2022-24921: Fixed a potential denial of service via large regular expressions bsc1196732. Non-security fixes: - Fixed an issue with v2 modules go51331. - Fixed an issue when building source in riscv64...

EvilSelenium - A Tool That Weaponizes Selenium To Attack Chromium Based Browsers

EvilSelenium is a new project that weaponizes Selenium to abuse Chromium-based browsers. The current features right now are: Steal stored credentials via autofill Steal cookies Take screenshots of websites Dump Gmail/O365 emails Dump WhatsApp messages Download & exfiltrate files Add SSH keys to...

CVE-2022-27041: Improper Neutralization of Special Elements used in an SQL Command

Due to lack of protection, parameter studentid in OpenSIS Classic 8.0 /modules/eligibility/Student.php can be used to inject SQL queries to extract information from databases...

PT-2022-18188

Name of the Vulnerable Software and Affected Versions OpenSIS Classic version 8.0 Description The issue is due to a lack of protection, allowing the student id parameter in the "/modules/eligibility/Student.php" endpoint to be used for injecting SQL queries, which can extract information from...

WebKitGTK WebKit Structure Data Compromise

The vulnerability of the Web page rendering modules in WebKitGTK and WPE WebKit relates to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to compromise the integrity of data...

WebKitGTK WebKit Information Disclosure

The vulnerability of the Web page rendering modules in WebKitGTK and WPE WebKit relates to the disclosure of information in the erroneous data area. Exploiting this vulnerability allows a remote attacker to gain access to confidential data...

tildearrow Furnace 安全漏洞

The tildearrow Furnace is a multi-system chip tuning tracker compatible with DefleMask modules. A security vulnerability exists in tildearrow Furnace that stems from an incomplete fix for CVE-2022-1211, resulting in a denial of service vulnerability...

CVE-2022-24822 Denial of Service in @podium/layout and @podium/proxy

Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a module for proxying HTTP requests from a layout server to a podlet server. In @podium/layout prior to version 4.6.110 and @podium/proxy prior to version 4.2.74,...