GHSA-8255-QF34-44MP Sensitive Cookie Without HttpOnly and Secure Flag

Mautic prior to 2.1.1 fails to set flags on session cookies...

GHSA-6R7R-JJ8H-PQ6V Deserialization of Untrusted Data in Jython

Jython before 2.7.1b3 allows attackers to execute arbitrary code via a crafted serialized PyFunction object...

SonicWall SMA1000 series 信任管理问题漏洞

The SonicWall SMA1000 series is a family of secure mobile access solutions from SonicWall USA, Inc. simplifies end-to-end secure remote access to enterprise resources hosted across local, cloud and hybrid data centers. A security vulnerability exists in SonicWall SMA1000 series firmware version...

EventSource 信息泄露漏洞

EventSource is a pure JavaScript implementation of the EventSource client. An information disclosure vulnerability exists in versions of EventSource prior to 2.0.2, which originates from exposing sensitive information to an unauthorized Actor...

PT-2022-3410 · Unknown +5 · Eventsource +5

Name of the Vulnerable Software and Affected Versions: eventsource/eventsource versions prior to 2.0.2 Description: The issue is related to insufficient protection of sensitive data, allowing a remote attacker to gain unauthorized access to protected information. This is due to the improper remov...

PT-2022-2829 · Sonicwall · Sonicwall Sma1000

Name of the Vulnerable Software and Affected Versions: SonicWall SMA1000 series firmware versions prior to 12.4.1-02965 Description: The issue is related to insufficient access control in the firmware of SonicWall SMA 1000 series firewalls. This can allow a remote attacker to gain unauthorized...

CVE-2021-33317

The TRENDnet TI-PG1284i switchhw v2.0R prior to version 2.0.2.S0 suffers from a null pointer dereference vulnerability. This vulnerability exists in its lldp related component. Due to fail to check if ChassisID TLV is contained in the packet, by sending a crafted lldp packet to the device, an...

CVE-2022-1621

Heap buffer overflow in vimstrncpy findword in GitHub repository vim/vim prior to 8.2.4919. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution...

CVE-2022-30233

A CWE-20: Improper Input Validation vulnerability exists that could allow the product to be maliciously manipulated when the user is tricked into performing certain actions on a webpage. Affected Products: Wiser Smart, EER21000 & EER21001 V4.5 and prior...

CVE-2022-30238

A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to take over the admin account when an attacker hijacks a session. Affected Products: Wiser Smart, EER21000 & EER21001 V4.5 and prior...

PT-2022-2656 · Microsoft · Visual Studio Code

Name of the Vulnerable Software and Affected Versions: Visual Studio Code versions prior to 1.67.1 Description: The vulnerability in Visual Studio Code is related to insufficient input validation. Exploitation of this issue may allow a remote attacker to execute arbitrary code. Recommendations: F...

Siemens JT2GO and Teamcenter Visualization

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Siemens Equipment: JT2GO, Teamcenter Visualization Vulnerabilities: Infinite Loop, Null Pointer Dereference, Integer Overflow to Buffer Overflow, Double Free, Access of Uninitialized Pointer 2. RISK EVALUATION Successful...

PT-2022-3426 · Eaton · Eaton Intelligent Power Manager

Name of the Vulnerable Software and Affected Versions: Eaton Intelligent Power Manager IPM versions prior to 1.70 Description: The issue exists due to insufficient validation of input from certain resources by the IPM software, leading to stored Cross site scripting. An attacker would need access...

CVE-2022-1621

Heap buffer overflow in vimstrncpy findword in GitHub repository vim/vim prior to 8.2.4919. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution...

Mozilla Firefox Security Feature Issue Vulnerability (CNVD-2023-17326)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security signature issue vulnerability exists in Mozilla Firefox versions prior to 100.0 that stems from Firefox for Android not properly logging and retaining HSTS settings. An attacker can exploit...

KeepKey firmware 输入验证错误漏洞

KeepKey firmware is an open source KeepKey device firmware from KeepKey USA. A security vulnerability exists in KeepKey versions prior to 7.3.2, which stems from lib/board/supervise.c incorrectly handling the svhandlerflash address range check...

CVE-2022-1616 Use after free in append_command in vim/vim

Use after free in appendcommand in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution...

CVE-2022-24099

Adobe Photoshop versions 22.5.6 and earlierand 23.2.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user...

TKVideoplayer 资源管理错误漏洞

TkVideoplayer is a video player for tkinter by Art/Paul Individual Developer in India. A security vulnerability exists in versions prior to TKVideoplayer 2.0.0, which stems from a memory issue when playing videos...

CVE-2022-28706

On F5 BIG-IP 16.1.x versions prior to 16.1.2 and 15.1.x versions prior to 15.1.5.1, when the DNS resolver configuration is used, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not...