12580 matches found
MGASA-2022-0409 Updated expat packages fix security vulnerability
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XMLExternalEntityParserCreate in out-of-memory situations. CVE-2022-43680...
MGASA-2022-0408 Updated ntfs-3g packages fix security vulnerability
NTFS-3G could be made to crash or run programs as an administrator if it mounted a specially crafted disk. CVE-2022-40284...
Apache Pulsar Disabled Certificate Validation for OAuth Client Credential Requests makes C++/Python Clients vulnerable to MITM attack
The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureConnection is disabled via configuration. This vulnerability allows an attacker to perform a man in the middle attack and intercept and/or...
SUSE-SU-2022:3868-1 Security update for rubygem-loofah
This update for rubygem-loofah fixes the following issues: - CVE-2019-15587: Fixed issue in sanitization of crafted SVG elements bsc1154751...
PT-2022-26976 · Ibm · Ibm Robotic Process Automation
Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation versions 21.0.1 through 21.0.5 Description: The issue is related to incorrect permission assignment, which could allow access to application configurations. Recommendations: For IBM Robotic Process Automation...
Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. This vulnerability is due to...
Cisco Email Security Appliance and Cisco Secure Email and Web Manager HTTP Response Header Injection Vulnerability
A vulnerability in Cisco Email Security Appliance ESA and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. This vulnerability is due to the failure of the application or its environment to properly sanitize input...
Cisco Umbrella Stored Cross-Site Scripting Vulnerability
A vulnerability in multiple management dashboard pages of Cisco Umbrella could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the Cisco Umbrella dashboard. This vulnerability is due to unsanitized user input. An attacker could exploit this...
Cisco Identity Services Engine Path Traversal Vulnerability
A vulnerability in the Localdisk Management feature of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to make unauthorized changes to the file system of an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this...
MGASA-2022-0402 Updated gdk-pixbuf2.0 packages fix security vulnerability
GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12. CVE-2021-44648...
SonicWall OpenSSL Version 3.x Security Advisory
This advisory is intended to cover the following OpenSSL Vulnerabilities CVE-2022-3358 - Using a Custom Cipher with NIDundef may lead to NULL encryptionFixed in OpenSSL 3.0.6 Affected OpenSSL Versions 3.x, 3.0.0-3.0.5.More vulnerability details are available here...
CVE-2022-3509 Parsing issue in protobuf textformat
A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes...
CVE-2022-42827
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 16.1 and iPadOS 16. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively...
PT-2025-5826 · Apache · Apache Shardingsphere Elasticjob-Ui
Name of the Vulnerable Software and Affected Versions: Apache ShardingSphere ElasticJob-UI versions prior to 3.0.2 Description: The issue allows an attacker to perform remote code execution RCE by constructing a special JDBC URL of the H2 database. The premise of this attack is that the attacker...
PT-2022-17585 · Muhammara +1 · Muhammara +1
Name of the Vulnerable Software and Affected Versions: muhammara versions prior to 2.6.0 hummus versions prior to 1.0.111 Description: The issue allows for Denial of Service DoS when the PDFStreamForResponse function is used with invalid data. Recommendations: For muhammara versions prior to 2.6....
PT-2022-21510 · Apple · Ios +1
Name of the Vulnerable Software and Affected Versions: iOS versions prior to 16 watchOS versions prior to 9 Description: The issue allows an app to potentially read a persistent device identifier. This was addressed with improved entitlements. Recommendations: For iOS versions prior to 16, update...
PT-2022-25404 · Unknown · Processwire
Name of the Vulnerable Software and Affected Versions: ProcessWire version 3.0.200 Description: A Cross-Site Request Forgery CSRF issue was discovered. Recommendations: For version 3.0.200, update to a newer version that contains a fix for this issue...
PT-2022-21356
Name of the Vulnerable Software and Affected Versions WordPress Classifieds Plugin versions prior to 4.3 Description The issue arises from the improper sanitization and escaping of certain parameters before they are used in a SQL statement. This occurs via an AJAX action that is accessible to...
OPENSUSE-SU-2022:10171-1 Security update for pdns-recursor
This update for pdns-recursor fixes the following issues: pdns-recursor was updated to 4.6.3: fixes incomplete exception handling related to protobuf message generation boo1202664, CVE-2022-37428 pdns-recursor was updated to 4.6.2: Reject non-apex NSEC3s that have both the NS and SOA bits set A...