2124 matches found
Johnson Controls Metasys ADS, ADX, OAS
1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls, Inc Equipment: Metasys ADS, ADX, OAS with MUI Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow...
java-11-openjdk security, bug fix, and enhancement update
1:11.0.16.0.8-1 - Update to jdk-11.0.16+8 - Update release notes to 11.0.16+8 - Use same tarball naming style as java-17-openjdk and java-latest-openjdk - Drop JDK-8257794 patch now upstreamed - Print release file during build, which should now include a correct SOURCE value from .src-rev - Updat...
Important: java-17-amazon-corretto
Issue Overview: Generated code produced by C1 may leak a package-private class to a class from a different package. CVE-2022-21540 MethodHandle.invokeBasic method can be accessed on byte code level from an arbitrary class. CVE-2022-21541 computeNextExponential sometimes returns negative numbers...
MAL-2022-2430 Malicious code in dependencies-zksync (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8331d5a7104e71dec7d39359757edf1a15fd227d0aa8c8589ed82cc45ec2c2c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Annotation Tool path traversal vulnerability
Annotation Tool is a Bonn activity map annotation tool open sourced by bonn-activity-maps. 2021-08-31 and earlier versions of Annotation Tool are vulnerable to a path traversal vulnerability that stems from a failure of Flask's sendfile function to properly filter special elements in a resource o...
Adobe Acrobat and Reader Access of Resource Using Incompatible Type (APSB22-32: CVE-2022-34221)
A vulnerability exists in Adobe Acrobat and Reader. Successful exploitation of this vulnerability could allow a remote attacker to damage users system...
foreman: Authenticate remote code execution through Sendmail configuration
A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite the defaults and perform command injection. The highest threat from this vulnerability is to confidentiality, integrity and availability o...
2022 CWE Top 25 Most Dangerous Software Weaknesses
The Homeland Security Systems Engineering and Development Institute, sponsored by CISA and operated by MITRE, has released the 2022 Common Weakness Enumeration CWE Top 25 Most Dangerous Software Weaknesses list. The list uses data from the National Vulnerability Database to compile the most...
IBM Curam Social Program Management会话固定漏洞
IBM Curam Social Program Management is an IBM business and technology solution that provides pre-built health and social program components, business processes, toolsets and interfaces on top of a dynamically configurable architecture. The vulnerability stems from the failure of the program to...
FFmpeg lag_decode_frame function code execution vulnerability
FFmpeg is a complete solution for recording, converting and streaming audio and video from the Ffmpeg team. A code execution vulnerability exists in the FFmpeg lagdecodeframe function, which could be exploited by attackers to execute arbitrary code on the system...
MAL-2022-5770 Malicious code in retrieval-components (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e8e0b9fc49fd66b253cbe5471b658ced8c291eaca4357787eb75dbd9c5da308 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Code injection
SAP PowerDesigner Proxy - version 16.7, allows an attacker with low privileges and has local access, with the ability to work around system’s root disk access restrictions to Write/Create a program file on system disk root path, which could then be executed with elevated privileges of the...
Dell SupportAssist Client Consumer and Dell SupportAssist Client Commercial Code Issue Vulnerability
Dell SupportAssist Client is a client application from Dell USA. The program provides automated, proactive and predictive techniques for troubleshooting, etc. The Dell SupportAssist Client Consumer and Dell SupportAssist Client Commercial code issue vulnerability could be exploited by an attacker...
Arbitrary file deletion
Dell SupportAssist Client Consumer versions 3.10.4 and versions prior and Dell SupportAssist Client Commercial versions 3.1.1 and versions prior contain an arbitrary file deletion vulnerability. Authenticated non-admin user could exploit the issue and delete arbitrary files on the system...
CVE-2022-29094
Dell SupportAssist Client Consumer versions 3.10.4 and versions prior and Dell SupportAssist Client Commercial versions 3.1.1 and versions prior contain an arbitrary file deletion/overwrite vulnerability. Authenticated non-admin user could exploit the issue and delete or overwrite arbitrary files...
Design/Logic Flaw
Rescue Dispatch Management System v1.0 is vulnerable to Delete any file via /rdms/classes/Master.php?f=deleteimg...
Keysight N6854A Geolocation server and N6841A RF Sensor software
1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Keysight Technologies, Inc. Equipment: N6854A Geolocation server and N6841A RF Sensor software Vulnerabilities: Relative Path Traversal, Deserialization of Untrusted Data 2. RISK EVALUATION Successful...
CVE-2022-1882
CVE-2022-1882: A use-after-free in Linux kernel pipes handling (pipes.post_one_notification after free_pipe_info) allows a local user to crash the system and potentially escalate privileges. Documented in CVE-2022-1882 with CVSS v3 base 7.8 (LOCAL, LOW complexity, user is not required to interact...
MAL-2022-2378 Malicious code in ddc-new-relic (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 724b8e2d9bbce93045922539d67f166495a0abac1fe3d410e5cea2ec861e82d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...