UBUNTU-CVE-2022-46908

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE...

Trend Micro Apex One 安全漏洞

Trend Micro Apex One is an endpoint protection software from Trend Micro. A security vulnerability exists in Trend Micro Apex One, which stems from the fact that the monitoring engine component of its Apex One service is compiled without using the /SAFESEH memory protection mechanism...

Insufficient Policy Enforcement

chromium is using Insufficient policy enforcement. The vulnerability exists due to the insufficient policy enforcement in the library, allowing an attacker to bypass the safe browsing warnings via a malicious file...

MintableIncentivizedERC721 incorrectly implements safe transfers

Lines of code Vulnerability details Impact MintableIncentivizedERC721 incorrectly implements safeTransfer and safeTransferFrom by simply replicating the unsafe transfer/transferFrom function. Raising as medium because as a consequence of this, these ERC721 tokens may end up locked in contracts th...

CVE-2022-45512

Tenda W30E V1.0.1.25633 was discovered to contain a stack overflow via the page parameter at /goform/SafeEmailFilter...

CVE-2022-45522

Tenda W30E V1.0.1.25633 was discovered to contain a stack overflow via the page parameter at /goform/SafeClientFilter...

CVE-2022-45521

Tenda W30E V1.0.1.25633 was discovered to contain a stack overflow via the page parameter at /goform/SafeUrlFilter...

CVE-2022-45519

Tenda W30E V1.0.1.25633 was discovered to contain a stack overflow via the Go parameter at /goform/SafeMacFilter...

Unsound API in `secp256k1` allows use-after-free and invalid deallocation from safe code

Because of incorrect bounds on method Secp256k1::preallocatedgennew it was possible to cause use-after-free from safe consumer code. It was also possible to "free" memory not allocated by the appropriate allocator. The method takes a place for storing the context as a mutable reference and return...

Tenda W30E 缓冲区错误漏洞

Tenda W30E is a router from Tenda China. A security vulnerability exists in Tenda W30E version V1.0.1.25633, which originates from a stack overflow in the page parameter via /goform/SafeClientFilter...

Chromium: CVE-2022-4195 Insufficient policy enforcement in Safe Browsing

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

PT-2022-16056 · Guarddog · Guarddog

Name of the Vulnerable Software and Affected Versions: GuardDog versions prior to v0.1.8 Description: GuardDog is a CLI tool to identify malicious PyPI packages. The issue arises when extracting files using shutil.unpack archive from a potentially malicious tarball without validating that the...

Android is slowly mastering memory management vulnerabilities

Recently we wrote about why the NSA wants you to shift to memory safe programming languages. The short version is: If you ever read our posts describing security vulnerabilities, you will see a lot of phrases like "buffer overflow", "failure to release memory", "use after free", "memory...

UBUNTU-CVE-2022-1471

SnakeYaml's Constructor class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. ...

RUSTSEC-2022-0070 Unsound API in `secp256k1` allows use-after-free and invalid deallocation from safe code

Because of incorrect bounds on method Secp256k1::preallocatedgennew it was possible to cause use-after-free from safe consumer code. It was also possible to "free" memory not allocated by the appropriate allocator. The method takes a place for storing the context as a mutable reference and return...

CVE-2022-4195

Insufficient policy enforcement in Safe Browsing in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass Safe Browsing warnings via a malicious file. Chromium security severity: Medium...

CVE-2022-4195

Insufficient policy enforcement in Safe Browsing in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass Safe Browsing warnings via a malicious file. Chromium security severity: Medium...

CVE-2022-4195

Insufficient policy enforcement in Safe Browsing in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass Safe Browsing warnings via a malicious file. Chromium security severity: Medium...

DEBIAN-CVE-2022-4195

Insufficient policy enforcement in Safe Browsing in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass Safe Browsing warnings via a malicious file. Chromium security severity: Medium...

CVE-2022-4195

Insufficient policy enforcement in Safe Browsing in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass Safe Browsing warnings via a malicious file. Chromium security severity: Medium...