CVE-2022-41779

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize network packets without proper verification. If the device connects to an attacker-controlled server, the attacker could send maliciously crafted packets that would be deserialized and executed, leading to remote...

The vulnerability of the performance.getEntries() method in browsers such as Mozilla Firefox, Firefox ESR, and the email client Thunderbird allows a malicious actor to bypass security restrictions and gain unauthorized access to protected information.

The vulnerability of the performance.getEntries method in Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to the inclusion of functions from an unverified controlled area. Exploiting this vulnerability could allow a remote attacker to obtain URL records from various...

PT-2022-6954 · Cisco · Cisco Ios Xr

Name of the Vulnerable Software and Affected Versions: Cisco IOS XR affected versions not specified Description: The issue is related to insufficient image verification in the iPXE boot function of Cisco IOS XR software. This could allow an authenticated, local attacker to install an unverified...

CVE-2022-41580

The HWKEYMASTER module has a vulnerability of not verifying the data read.Successful exploitation of this vulnerability may cause malicious construction of data, which results in out-of-bounds access...

CVE-2022-39254 When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarder

matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a users requests a room key from their devices, the software correctly remember the request. Once they receive a forwarded room key, they accept it without checking who the room ke...

DEBIAN-CVE-2022-2785

There exists an arbitrary memory read within the Linux Kernel BPF - Constants provided to fill pointers in structs passed in to bpfsysbpf are not verified and can point anywhere, including memory not owned by BPF. An attacker with CAPBPF can arbitrarily read memory from anywhere on the system. We...

AZL-11015 CVE-2022-2785 affecting package kernel for versions less than 5.15.82.1-1

There exists an arbitrary memory read within the Linux Kernel BPF - Constants provided to fill pointers in structs passed in to bpfsysbpf are not verified and can point anywhere, including memory not owned by BPF. An attacker with CAPBPF can arbitrarily read memory from anywhere on the system. We...

UBUNTU-CVE-2022-2785

There exists an arbitrary memory read within the Linux Kernel BPF - Constants provided to fill pointers in structs passed in to bpfsysbpf are not verified and can point anywhere, including memory not owned by BPF. An attacker with CAPBPF can arbitrarily read memory from anywhere on the system. We...

Linux kernel 缓冲区错误漏洞

The Linux kernel is an open source Unix-like operating system macro kernel for efficient resource management. A security vulnerability exists in the Linux Kernel where constants used to populate pointers in structures passed to bpfsysbpf are unverified and can point anywhere, and an attacker with...

CVE-2022-40139

Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code executio...

CVE-2022-40139

Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code executio...

nodejs-got: missing verification of requested URLs allows redirects to UNIX sockets

A flaw was found in the got package for node.js. Requested URLs are not verified and allow open redirection to a local UNIX socket...

Adobe InCopy < 16.4.3 / 17.0 < 17.4.0 Multiple Vulnerabilities (APSB22-53)

The version of Adobe InCopy installed on the remote host is prior to 16.4.3, 17.4.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB22-53 advisory. - Adobe InCopy version 17.3 and earlier and 16.4.2 and earlier are affected by a Heap-based Buffer Overflow...

CVE-2022-36073 RubyGems allows creation of users with arbitrary unverified emails

RubyGems.org is the Ruby community gem host. A bug in password & email change confirmation code allowed an attacker to change their RubyGems.org account's email to an unowned email address. Having access to an account whose email has been changed could enable an attacker to save API keys for that...

CVE-2022-3152

Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20...

LinkedIn: A Unverified User Can Post Newsletter (Which Is Not Allowed Through Application UI)

A vulnerability was discovered in LinkedIn that allowed unverified users to create newsletters, even though this feature was not accessible to them through the application's user interface. By sending a specific request with the unverified user's cookie, the newsletter creation API could be...

CVE-2022-3152 Unverified Password Change in phpfusion/phpfusion

Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20...

CVE-2022-3152

CVE-2022-3152 affects phpfusion/phpfusion prior to 9.10.20. The issue is described as an unverified password change, enabling account takeover. Connected documents corroborate the vulnerability class as improper/authentication weakness and consistently point to versions before 9.10.20. The remedi...

phpfusion 授权问题漏洞

PHPFusion is a Malaysian PHPFusion company based on MySql and PHP open source lightweight content management system . The system contains modules for news, articles and forums. A security vulnerability exists in PHPFusion versions prior to 9.10.20, which stems from an unverified password change...

PT-2022-4843

Name of the Vulnerable Software and Affected Versions Trend Micro Apex One and Trend Micro Apex One as a Service affected versions not specified Description The issue is related to improper validation of components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as...