6884 matches found
threat-intel
threat-intel This repository contains supplemental items inclu...
CVE-2021-4126
When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a message footer added by a mailing list gateway, Thunderbird only considered the inner signed message for the signature validity. This gave the false impression that the addition...
dbus: dbus-daemon crashes when receiving message with incorrectly nested parentheses and curly brackets
A vulnerability found in D-bus. This flaw allows an authenticated attacker to cause dbus-daemon and other programs that use libdbus to crash when receiving a message with specific invalid type signatures...
Infinite approval given to DepositTradeHelper contract can be misused by malicious actors
Lines of code Vulnerability details Impact depositAndTrade function in DepositTradeHelper account has infinite approval to spend baseTokens & collateralTokens of user using offChain signatures. However, once swapRouter executes UniV3 swap transaction on line 33, the contract does not give up its...
Amazon Linux 2022 : nss (ALAS2022-2022-223)
The version of nss installed on the remote host is prior to 3.83.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-223 advisory. - NSS Network Security Services versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA...
bls-signatures:cryptofuzz-bls-signatures: Nested bug in the same thread, aborting. with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=6731060031651840 Project: bls-signatures Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-bls-signatures Job Type: libfuzzermsanbls-signatures Platform Id: linux Crash Type: Nested bug in the same thread, aborting. Crash Address: Crash State: NU...
dbus: dbus-daemon crashes when receiving message with incorrectly nested parentheses and curly brackets
A vulnerability found in D-bus. This flaw allows an authenticated attacker to cause dbus-daemon and other programs that use libdbus to crash when receiving a message with specific invalid type signatures...
Simple:Press < 6.8.1 - Subscriber+ Stored XSS via Profile Signatures
The plugin does not sanitise and escape the postitem parameter when modifying profile signatures, which could allow any authenticated users, such as subscriber to perform Stored XSS attacks...
PT-2022-25318 · WordPress · Simple:Press
Name of the Vulnerable Software and Affected Versions: Simple:Press plugin for WordPress versions up to, and including, 6.8 Description: The issue allows for Stored Cross-Site Scripting via the postitem parameter when modifying a profile signature. This is due to insufficient input sanitization a...
Rocky Linux 8 : libreoffice (RLSA-2022:1766)
The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:1766 advisory. - LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurr...
Oracle Linux 8 : libreoffice (ELSA-2022-7461)
The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-7461 advisory. 6.4.7.2-11.0.1 - Replace colors with Oracle colors Orabug: 32120093 - Build with --with-vendor=Oracle America, Inc. - Added the --with-hamcrest option to...
NewStart CGSL MAIN 6.02 : nss Multiple Vulnerabilities (NS-SA-2022-0098)
The remote NewStart CGSL host, running version MAIN 6.02, has nss packages installed that are affected by multiple vulnerabilities: - A flaw was found in the way NSS handled CCS ChangeCipherSpec messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denia...
ALSA-2022:7955 Moderate: skopeo security and bug fix update
The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fixes: containers/storage: DoS via malicious image CVE-2021-20291 golang: math/big.Rat: may cause a panic or an unrecoverable fatal erro...
EulerOS 2.0 SP9 : gnutls (EulerOS-SA-2022-2765)
According to the versions of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may...
EulerOS 2.0 SP9 : gnutls (EulerOS-SA-2022-2730)
According to the versions of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may...
Huawei EulerOS: Security Advisory for gnutls (EulerOS-SA-2022-2765)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
AlmaLinux 8 : libreoffice (ALSA-2022:7461)
The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:7461 advisory. - LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since th...
OESA-2022-2051 dbus security update
Security Fixes: An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures.CVE-2022-42010 An...
