Input validation

Improper isolation of shared resources in network on chip for the IntelR 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially enable denial of service via local access...

Design/Logic Flaw

Improper initialization of shared resources in some IntelR Processors may allow an authenticated user to potentially enable information disclosure via local access...

CVE-2022-22780 Zoom Chat Susceptible to Zip Bombing

The Zoom Client for Meetings chat functionality was susceptible to Zip bombing attacks in the following product versions: Android before version 5.8.6, iOS before version 5.9.0, Linux before version 5.8.6, macOS before version 5.7.3, and Windows before version 5.6.3. This could lead to availabili...

CVE-2021-33096

Improper isolation of shared resources in network on chip for the IntelR 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially enable denial of service via local access...

CVE-2021-0145

Improper initialization of shared resources in some IntelR Processors may allow an authenticated user to potentially enable information disclosure via local access...

Path Traversal

A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources endpoint applies a transformation of the url path to the file path. Only few specific folder hierarchies can be exposed by this flaw...

PT-2022-15505 · Sap · Sap Erp Hcm Portugal

Name of the Vulnerable Software and Affected Versions: SAP ERP HCM Portugal versions 600 through 608 Description: The issue concerns a report that reads payroll data of employees in a certain area without performing necessary authorization checks. This allows an attacker to access payroll...

AlmaLinux 8 : expat (ALSA-2020:4484)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:4484 advisory. - In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount o...

AlmaLinux 8 : libreoffice (ALSA-2020:4628)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:4628 advisory. - LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the...

ArchiSteamFarm 访问控制错误漏洞

ArchiSteamFarm is a C application whose main purpose is to idle Steam cards from multiple accounts simultaneously. An Access Control Error vulnerability exists in ArchiSteamFarm that stems from the product not adequately validating the sending agent. An attacker could use this vulnerability to...

Radareorg Radare2 资源管理错误漏洞

radare2 is a set of libraries and tools for working with binary files. radareorg Radare2 is vulnerable to a resource management error that stems from the product's reuse of released resources. No detailed vulnerability details are currently available...

2021.2 IPU - Intel® Processor Shared Resource Advisory

Summary: A potential security vulnerability in some Intel® Processors may allow information disclosure. Intel is releasing firmware updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2021-0145 Description: Improper initialization of shared resources in some IntelR...

Qualcomm 多款产品输入验证错误漏洞

The Qualcomm Qca chip and others are products of Qualcomm Incorporated.The Qualcomm Qca chip is a Bluetooth module chip.The Qualcomm Sd chip is a processor.The Qualcomm Wcd chip is an Aqstic™ audio codec. An input validation error vulnerability exists in multiple Qualcomm products. The...

MariaDB 资源管理错误漏洞

MariaDB is a free and open source database management system from the MariaDB Mariadb Foundation and a forked version of MySQL with the Maria storage engine. A resource management error vulnerability exists in MariaDB that stems from the product's convertconsttoint function reusing freed resource...

Mageia: Security Advisory (MGASA-2014-0214)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Infinite Loop in Apache Xerces Java

There's a vulnerability within the Apache Xerces Java XercesJ XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present withi...

Cesanta MJS 安全漏洞

Cesanta MJS is an embedded JavaScript engine for C/C from Cesanta Ireland. It is designed for microcontrollers with limited resources. The main design goals are small footprint and simple C/C interoperability.Cesanta MJS has a security vulnerability that could be exploited by an attacker to cause...

xstream: Server-side request forgery (SSRF) via unsafe deserialization of com.sun.xml.internal.ws.client.sei.*

A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to request data from internal resources that are not publicly available by manipulating the processed input stream with Java runtime versions 14 to 8. The highest thre...

xstream: Server-side request forgery (SSRF) via unsafe deserialization of com.sun.xml.internal.ws.client.sei.*

A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to request data from internal resources that are not publicly available by manipulating the processed input stream with Java runtime versions 14 to 8. The highest thre...

xstream: Server-side request forgery (SSRF) via unsafe deserialization of jdk.nashorn.internal.runtime.Source$URLData

A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to request data from internal resources that are not publicly available by manipulating the processed input stream with Java runtime versions 14 to 8. The highest thre...