TiDB vulnerable to Use of Externally-Controlled Format String

TiDB server importer CLI tool prior to version 6.4.0 & 6.1.3 is vulnerable to data source name injection. The database name for generating and inserting data into a database does not properly sanitize user input which can lead to arbitrary file reads."...

Denial Of Service (DOS)

Kernel is vulnerable to out of bound reads. A KVM guest using SEV-ES can trigger out-of-bounds reads and writes in the host kernel via the SVMEXITIOIO exit reason...

Huawei EulerOS: Security Advisory for libtar (EulerOS-SA-2022-2713)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2022-20025 · Tidb · Tidb

Name of the Vulnerable Software and Affected Versions: TiDB versions prior to 6.4.0 TiDB versions prior to 6.1.3 Description: The issue concerns the use of an externally-controlled format string and data source name injection in the TiDB server. Specifically, the database name for generating and...

Arbitrary Code Execution

mruby is vulnerable to arbitrary code executions. The vulnerability exists due to out-of-bounds reads in mrbobjiskindof in which allows an attacker to execute arbitrary codes in the system...

Aruba Networks ArubaOS 代码问题漏洞

Aruba Networks ArubaOS is an operating system for Aruba Mobility-Defined Networks, including Mobility Controllers and Mobility Access Switches, from Aruba Networks, Inc. A security vulnerability exists in Aruba Networks ArubaOS that stems from an XML External Entity Injection XXE vulnerability...

Invalid use of `mem::uninitialized` causes `use-of-uninitialized-value`

The compression and decompression function used mem:uninitialized to create an array of uninitialized values, to later write values into it. This later leads to reads from uninitialized memory. The flaw was corrected in commit b633bf265e41c60dfce3be7eac4e4dd5e18d06cf by using a heap-allocated Vec...

PT-2025-37519

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a data-race condition within the kcm Kernel Connection Multiplexor subsystem. Specifically, kcm-rx psock can be read without a lock in the kcm rfree function,...

The vulnerability of the Moxa MXView network control software lies in its lack of functionality for checking the path name of the restricted access directory. This allows attackers to read arbitrary files.

The vulnerability of the Moxa MXView network control software is related to deficiencies in checking the path name to the restricted access catalog. Exploiting this vulnerability allows a malicious actor to read arbitrary files remotely...

Oracle Supply Chain Information Disclosure Vulnerability (CNVD-2023-11168)

Oracle Supply Chain Products Suite is a set of supply chain solutions from Oracle Oracle. The product provides value chain planning, value chain execution, product lifecycle management and other functions. An information disclosure vulnerability exists in Oracle Transportation Management versions...

Oracle MySQL Installer Information Disclosure Vulnerability (CNVD-2023-01497)

Oracle MySQL Server is a relational database from Oracle Corporation. An information disclosure vulnerability exists in the Installer: General component of Oracle MySQL Installer 1.6.3 and earlier versions. An attacker can exploit this vulnerability to corrupt MySQL Installer and perform...

CVE-2022-39404

Vulnerability in the MySQL Installer product of Oracle MySQL component: Installer: General. Supported versions that are affected are 1.6.3 and prior. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Installer executes to compromise MyS...

CVE-2022-21629

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Web Runtime SEC. Supported versions that are affected are 9.2.6.4 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards...

Oracle JD Edwards Products 安全漏洞

Oracle JD Edwards Products is a fully integrated suite of Enterprise Resource Planning ERP applications from Oracle. The products offer application modules for financial management, project management, and asset lifecycle management. A security vulnerability exists in Oracle JD Edwards' JD Edward...

Oracle MySQL 安全漏洞

Oracle MySQL Server is a relational database from Oracle Corporation. An information disclosure vulnerability exists in the Installer: General component of Oracle MySQL Installer 1.6.3 and earlier versions. An attacker can exploit this vulnerability to corrupt MySQL Installer and perform...

Adobe ColdFusion XML External Entity Injection Vulnerability (CNVD-2023-08756)

Adobe ColdFusion is a rapid application development platform from Adobe, which includes an integrated development environment and scripting language. The platform includes an integrated development environment and scripting language.Adobe ColdFusion has an XML external entity injection...

Adobe ColdFusion input validation error vulnerability

Adobe ColdFusion is a rapid application development platform from Adobe, which includes an integrated development environment and scripting language. Adobe ColdFusion is vulnerable to an input validation error that could be exploited by an attacker to cause arbitrary file system reads...

Adobe ColdFusion XML External Entity Injection Vulnerability

Adobe ColdFusion is a rapid application development platform from Adobe, which includes an integrated development environment and scripting language. The platform includes an integrated development environment and scripting language.Adobe ColdFusion has an XML external entity injection...

Adobe Dimension < 3.4.6 Multiple Vulnerabilities (APSB22-57)

The version of Adobe Dimension installed on the remote host is prior to 3.4.6. It is, therefore, affected by multiple vulnerabilities, including the following: - Two arbitrary code execution vulnerabilities caused by out-of-bounds reads. An unauthenticated, local attacker can exploit these to...

Bentley Systems MicroStation和Bentley View 缓冲区错误漏洞

Bentley Systems MicroStation and Bentley View are both products of Bentley Systems, Inc.MicroStation is a Cad software platform for 2D and 3D design and drafting.Bentley View is a free viewer.... A buffer error vulnerability exists in MicroStation versions prior to 10.17.01.58 and Bentley View...