Remote code execution

IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot sends HTTP requests in their update procedure in order to download a config file. After downloading the config file, the products will parse the HTTP location of the update from the file a...

CVE-2022-24140

The CVE-2022-24140 entry affects IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot. The issue arises in the update mechanism: products fetch a config file via HTTP, parse the update location from that file, and automatically install updat...

PT-2022-16490

Name of the Vulnerable Software and Affected Versions IOBit Advanced System Care version 15 iTop Screen Recorder version 2.1 iTop VPN version 3.2 Driver Booster version 9 iTop Screenshot affected versions not specified Description The issue concerns the update procedure of the affected software,...

CVE-2022-24140: Download of Code Without Integrity Check

IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot sends HTTP requests in their update procedure in order to download a config file. After downloading the config file, the products will parse the HTTP location of the update from the file a...

多款IOBit产品安全漏洞

IOBit Advanced System Care Free is a system management utility. iTop Screen Recorder is a powerful free Windows screen recorder. iTop VPN is a VPN software. iTop VPN is a VPN software. IOBit Advanced System Care Free is a system management utility. iTop Screen Recorder is a product of iTop. iTop...

ROS-20220705-01

Caribou on-screen keyboard vulnerability, related to buffer overflow in XkbSetDeviceInfo and SetDeviceIndicators. Exploitation of the vulnerability could allow an attacker, when invoking the functionality of the the on-screen keyboard functionality from the screen keeper, crash libcaribou, crash...

gnome-control-center bug fix and enhancement update

An update is available for gnome-control-center. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The gnome-control-center package contains configuration utilitie...

CVE-2022-33202

Authentication bypass vulnerability in the setup screen of L2Blockeron-premise Ver4.8.5 and earlier and L2BlockerCloud Ver4.8.5 and earlier allows an adjacent attacker to perform an unauthorized login and obtain the stored information or cause a malfunction of the device by using alternative path...

Authentication flaw

Authentication bypass vulnerability in the setup screen of L2Blockeron-premise Ver4.8.5 and earlier and L2BlockerCloud Ver4.8.5 and earlier allows an adjacent attacker to perform an unauthorized login and obtain the stored information or cause a malfunction of the device by using alternative path...

PT-2022-21739

Name of the Vulnerable Software and Affected Versions L2Blockeron-premise versions 4.8.5 and earlier L2BlockerCloud versions 4.8.5 and earlier Description The issue allows an adjacent attacker to bypass authentication in the setup screen, potentially leading to unauthorized login, access to store...

CVE-2022-33202: Improper Authentication

Authentication bypass vulnerability in the setup screen of L2Blockeron-premise Ver4.8.5 and earlier and L2BlockerCloud Ver4.8.5 and earlier allows an adjacent attacker to perform an unauthorized login and obtain the stored information or cause a malfunction of the device by using alternative path...

Design/Logic Flaw

The tested version of Dominion Voting Systems ImageCast X’s on-screen application hash display feature, audit log export, and application export functionality rely on self-attestation mechanisms. An attacker could leverage this vulnerability to disguise malicious applications on a device...

OESA-2022-1723 giflib security update

giflib is a library of gif images and provides utilities for processing images. Security Fixes: There is a heap-buffer-overflow in GIFLIB 5.2.1 function DumpScreen2RGB in gif2rgb.c:298:45.CVE-2022-28506...

Loading Page with Loading Screen < 1.0.83 - Admin+ Stored Cross-Site Scripting

The plugin does not escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. Go to Settings - Loading Page, in the "Display loading screen in" settings, select either "specific pages" or "specif...

MAL-2022-2078 Malicious code in com.unity.modules.screencapture (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5366acc1724e2c06f0d14d7c184f5a94703e4be8fcbcfa54e355e71653d1a39e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3830 Malicious code in ing-message-screen (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4923616a2abf52da7beb97986ec338b87e015083100dd3941312a946560877a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WooCommerce < 6.6.0 - Admin+ Stored HTML Injection

The plugin is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles PoC Go to WooCommerce - Settings - Payments tab, enable BAC Bank Account Transfers and edit the title in the setup dialog. HTML can be injected there, and will be rendered both f...

[SECURITY] Fedora 36 Update: liblouis-3.22.0-1.fc36

Liblouis is an open-source braille translator and back-translator named in honor of Louis Braille. It features support for computer and literary braille, supports contracted and uncontracted translation for many languages and has support for hyphenation. New languages can easily be added through...

CVE-2022-32230

Microsoft Windows SMBv3 suffers from a null pointer dereference in versions of Windows prior to the April, 2022 patch set. By sending a malformed FileNormalizedNameInformation SMBv3 request over a named pipe, an attacker can cause a Blue Screen of Death BSOD crash of the Windows kernel. For most...

CVE-2022-32230

Microsoft Windows SMBv3 suffers from a null pointer dereference in versions of Windows prior to the April, 2022 patch set. By sending a malformed FileNormalizedNameInformation SMBv3 request over a named pipe, an attacker can cause a Blue Screen of Death BSOD crash of the Windows kernel. For most...