CVE-2022-28877 Local Privilege Escalation Vulnerability in F-Secure & WithSecure Windows Endpoint Products

This vulnerability allows local user to delete arbitrary file in the system and bypassing security protection which can be abused for local privilege escalation on affected F-Secure & WithSecure windows endpoint products. An attacker must have code execution rights on the victim machine prior to...

Drupal 9.3.x < 9.3.19 Multiple Vulnerabilities

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.91, 9.3.x prior to 9.3.19 or 9.4.x prior to 9.4.3. It is, therefore, affected by multiple vulnerabilities: - In some situations, the Image module does not correctly check access to...

CVE-2022-34232

Adobe Acrobat Reader versions 22.001.20142 and earlier, 20.005.30334 and earlier and 17.012.30229 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR...

Github Git 代码问题漏洞

Github Git is a free, open source distributed version control system. A security vulnerability exists in Github Git that originates from the ability to bypass secure directory protection and affects the following products and versions: Git versions prior to 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4,...

Apple macOS PackageKit PKCoreShove Link Following System Integrity Protection Bypass Vulnerability

This vulnerability allows local attackers to bypass System Integrity Protection on affected installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within PackageKi...

The vulnerability of the Linux operating system’s kernel, which allows a hacker to disclose protected information

The vulnerability of the Linux operating system’s kernel is related to a flaw in the Cortex and Neoverse processors from Arm. Exploiting this vulnerability can allow attackers to disclose sensitive information by circumventing the eIBRS and CSV2 protection mechanisms...

Private Files <= 0.40 - Protection Disabling via CSRF

The plugin is missing CSRF check when disabling the protection, which could allow attackers to make a logged in admin perform such action via a CSRF attack and make the blog public PoC That will also delete the .htaccess...

WordPress iQ Block Country plugin <= 1.2.13 - Protection Bypass due to IP Spoofing vulnerability

Protection Bypass due to IP Spoofing vulnerability discovered by Daniel Ruf in WordPress iQ Block Country plugin versions = 1.2.13. Solution Deactivate and delete. This plugin has been closed as of April 20, 2022 and is not available for download. This closure is temporary, pending a full review...

iQ Block Country <= 1.2.18 - Protection Bypass due to IP Spoofing

The plugin does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers. PoC curl -i -H 'CF-CONNECTING-IP: 0.0.0.0' https://example.com...

Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack

Jenkins before 1.640 and LTS before 1.625.2 allow remote attackers to bypass the CSRF protection mechanism via unspecified vectors...

DEBIAN-CVE-2022-1621

Heap buffer overflow in vimstrncpy findword in GitHub repository vim/vim prior to 8.2.4919. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution...

kernel: stack information leak in infiniband RDMA

A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdmacm device node. While this access is unlikely to leak sensitive user information, it can be...

CVE-2022-1621 Heap buffer overflow in vim_strncpy find_word in vim/vim

Heap buffer overflow in vimstrncpy findword in GitHub repository vim/vim prior to 8.2.4919. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution...

DEBIAN-CVE-2022-1616

Use after free in appendcommand in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution...

Design/Logic Flaw

Use after free in appendcommand in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution...

UBUNTU-CVE-2022-1616

Use after free in appendcommand in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution...

The vulnerability of the `iconv_mime_decode_headers` function within the `Iconv` extension of the PHP language allows attackers to trigger incomplete output arrays, bypass spam protection mechanisms, or otherwise affect the system.

The vulnerability of the iconvmimedecodeheaders function in the Iconv extension of the PHP language is related to errors in number processing. Exploiting this vulnerability can allow an attacker to cause incomplete output arrays, bypass spam protection mechanisms, or otherwise affect the system b...

libxml2: Exponential entity expansion attack bypasses all existing protection mechanisms

A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service...

ALPINE-CVE-2022-1381

global heap buffer overflow in skiprange in GitHub repository vim/vim prior to 8.2.4763. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution...

CVE-2022-24712 Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A vulnerability in versions prior to 4.1.9 might allow remote attackers to bypass the CodeIgniter4 Cross-Site Request Forgery CSRF protection mechanism. Users should upgrade to version 4.1.9. There are workarounds for...