Dev Server XSS

Description The developer server unsafely renders the stack trace within errors. This can be manipulated by sending a specially crafted request. Root Cause The error-dev.vuetemplate, within @nuxt\ui-templates uses the v-html directive to render the stacktrace section of the error. vue This would...

UBUNTU-CVE-2022-39837

An issue was discovered in Connected Vehicle Systems Alliance COVESA dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a NULL pointer dereference,...

dlt-daemon 缓冲区错误漏洞

Dlt-daemon is the DLT communication interface for Genivia's ECU. It collects and buffers log messages from one or more DLT users running on the ECU and makes them available to DLT clients upon request. A buffer overflow vulnerability exists in Genivia Dlt-daemon 2.18.8 and prior versions, which...

Security Bulletin: Multiple security vulnerabilities addressed in IBM Sterling Secure Proxy (CVE-2013-0518, CVE-2013-0519, CVE-2013-0520)

Abstract IBM Sterling Secure Proxy is vulnerable to spoofing and information disclosure attacks. Content VULNERABILITY DETAILS CVE ID: CVE-2013-0518 DESCRIPTION: Application Pages Do Not Break Out of 3rd Party HTML Frames. IBM Sterling Secure Proxy Configuration Manager pages permit rendering...

Security Bulletin: Tivoli Federated Identity Manager - Passwords exposed in trace files (CVE-2012-3310)

Abstract SUMMARY It is possible to configure Tivoli Federated Identity Manager TFIM in such a way that the logging of certain activities could result in the trace files produced by TFIM containing passwords that are either in clear text or obfuscated in a manner that the password can be derived...

OSV-2022-943 UNKNOWN WRITE in perfetto::trace_processor::TrackEventParser::ParseTrackDescriptor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51695 Crash type: UNKNOWN WRITE Crash state: perfetto::traceprocessor::TrackEventParser::ParseTrackDescriptor perfetto::traceprocessor::TrackEventModule::ParsePacket...

PT-2022-37301 · Perfetto · Perfetto

Name of the Vulnerable Software and Affected Versions: perfetto affected versions not specified Description: The issue is related to a crash in the perfetto trace processor. The crash occurs in the TrackEventParser::ParseTrackDescriptor function, which is called by TrackEventModule::ParsePacket a...

Security Bulletin: IBM Maximo Asset Management could disclose sensitive information from a stack trace after submitting incorrect login onto Cognos browser (CVE-2016-5896)

Summary IBM Maximo Asset Management could disclose sensitive information from a stack trace after submitting incorrect login onto Cognos browser. Vulnerability Details CVEID: CVE-2016-5896 DESCRIPTION: IBM Maximo Asset Management could disclose sensitive information from a stack trace after...

GSD-2022-1006130 spmi: trace: fix stack-out-of-bound access in SPMI tracing functions

spmi: trace: fix stack-out-of-bound access in SPMI tracing functions This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.256 by commit...

GSD-2022-1005324 io_uring: fix io_uring_cqe_overflow trace format

iouring: fix iouringcqeoverflow trace format This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.2 by commit...

GSD-2022-1005117 ice: Fix call trace with null VSI during VF reset

ice: Fix call trace with null VSI during VF reset This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.4 by commit...

Sensitive Information Disclosure

wildfly is vulnerable to sensitive information disclosure. It allows an attacker to see deployment names, endpoints, and any other data the trace payload may contain...

PT-2022-33375 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.19 through v5.19.3 Description: The issue is related to a potential security vulnerability in the Linux Kernel. It involves a fix for a call trace with a null VSI during VF reset. The actual impact and attack...

PT-2022-33580 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.2 Description: The issue is related to the arm64 architecture and the selection of TRACE IRQFLAGS NMI SUPPORT. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

GHSA-FMQ7-GH8V-MJVC WildFly vulnerable to Insecure Default Initialization of Resource

A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain...

CVE-2022-1278

A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain...

PT-2022-13768 · Wildfly · Wildfly

Name of the Vulnerable Software and Affected Versions: WildFly affected versions not specified Description: A flaw was found in WildFly, allowing an attacker to see deployment names, endpoints, and any other data the trace payload may contain. Recommendations: At the moment, there is no informati...

CVE-2022-37777

Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers 3.0.1.17 and earlier were discovered to contain a remote command execution RCE vulnerability via the trHops parameter of the tracert function...

OSV-2022-854 Heap-buffer-overflow in perfetto::trace_processor::TrackEventParser::ParseTrackDescriptor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51022 Crash type: Heap-buffer-overflow WRITE 4 Crash state: perfetto::traceprocessor::TrackEventParser::ParseTrackDescriptor perfetto::traceprocessor::TrackEventModule::ParsePacket...

NULL Pointer Dereference in function do_mouse

Description NULL Pointer Dereference in function domouse at vim/src/mouse.c:496 . vim version git log commit 171c683237149262665135c7d5841a89bb156f53 HEAD - master, tag: v9.0.0242, origin/master, origin/HEAD Proof of Concept ./vim -u NONE -X -Z -e -s -S /home/fuzz/test/poc3null.dat -c :qa!...