56 matches found
ROS-2-2174
2.2174 Vulnerability in SpamAssassin spam filtering tool CVE-2020-1946 1. Vulnerability Description: CVE-2020-1946 A vulnerability in the SpamAssassin spam filtering tool, is related to improper input validation when processing rule configuration .cf files. Exploitation of the vulnerability could...
Medium: bash
Issue Overview: A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parametertransform. This issue may lead to memory problems. CVE-2022-3715 Affected Packages: bash Issue Correction: Run dnf update bash --releasever 2023.0.20230322 or dnf update --advisory...
K99038439: NodeJS vulnerability CVE-2012-2330
Security Advisory Description The Update method in src/nodehttpparser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain sensitive information request header contents and possibly spoof HTTP headers via a zero...
Description of the security update for Office Web Apps Server 2013: November 8, 2022 (KB5002261)
Description of the security update for Office Web Apps Server 2013: November 8, 2022 KB5002261 Applies To Office Web Apps Server 2013 Summary This security update resolves a Microsoft Word information disclosure vulnerability, Microsoft Word remote code execution vulnerability, and Microsoft Exce...
CVE-2022-36101 Sensitive data in backend customer module
Shopware is an open source e-commerce software. In affected versions the request for the customer detail view in the backend administration contained sensitive data like the hashed password and the session ID. These fields are now explicitly unset in version 5.7.15. Users are advised to update an...
H3C GR-1200W Buffer Error Vulnerability
The H3C GR-1200W is a Gigabit enterprise wireless router from China's Xinhua San H3C. A security vulnerability exists in the H3C GR-1200W MiniGRW1A0V100R006 version that stems from a stack overflow in the UpdateWanLinkspyMulti method...
Security update for containerd (moderate)
openSUSE Security Update: Security update for containerd Announcement ID: openSUSE-SU-2021:2412-1 Rating: moderate References: 1188282 Cross-References: CVE-2021-32760 CVSS scores: CVE-2021-32760 SUSE: 3 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 An update...
Description of the security update for Office 2013: April 14, 2020
Description of the security update for Office 2013: April 14, 2020 Summary This security update resolves a remote code execution vulnerability that exists if Microsoft Office incorrectly loads arbitrary type libraries. To learn more about the vulnerability, see Microsoft Common Vulnerabilities an...
Servicing stack update for Windows 10, version 1903 and 1909: January 14, 2020
Servicing stack update for Windows 10, version 1903 and 1909: January 14, 2020 Applies To Windows 10, version 1903, all editions Windows 10, version 1909, all editions Summary This update makes quality improvements to the servicing stack, which is the component that installs Windows updates...
grub2 security update
2.02-78.0.2 - grub-set-bootflag: fix grubenv update method, fix CVE-2019-14865 Orabug: 30607067...
Servicing stack update for Windows 10, Version 1703: July 9, 2019
Servicing stack update for Windows 10, Version 1703: July 9, 2019 Applies To Windows 10, version 1703, all editions Summary This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. Key changes include: Addresses an issue with a Secure Bo...
Description of the security update for Office Online Server: June 11, 2019
Description of the security update for Office Online Server: June 11, 2019 Summary This security update resolves a remote code execution vulnerability that exists in Microsoft Word software if the program does not correctly handle objects in memory. To learn more about the vulnerability, see...
Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15866)
The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the "user update" method in versions of Quest DR Series disk backup software prior to version 4.0.3.1. An attacker could exploit this vulnerability to execute arbitrary system commands...
kernel: local privesc in key management
A flaw was found in the Linux kernel's key management system where it was possible for an attacker to escalate privileges or crash the machine. If a user key gets negatively instantiated, an error code is cached in the payload area. A negatively instantiated key may be then be positively...
Exponent CMS SQL Injection Vulnerability (CNVD-2016-10804)
Exponent is a web content management system. Multiple SQL injection vulnerabilities exist in the framework/modules/core/controllers/expRatingController.php/update method in Exponent CMS version 2.4.0, which can be exploited by an authenticated remote user to execute arbitrary SQL commands via the...
CVE-2016-9242
Multiple SQL injection vulnerabilities in the update method in framework/modules/core/controllers/expRatingController.php in Exponent CMS 2.4.0 allow remote authenticated users to execute arbitrary SQL commands via the 1 contenttype or 2 subtype parameter...
CVE-2012-2330
The Update method in src/nodehttpparser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain sensitive information request header contents and possibly spoof HTTP headers via a zero length string...
CVE-2012-2330
The Update method in src/nodehttpparser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain sensitive information request header contents and possibly spoof HTTP headers via a zero length string...
CVE-2012-2330
The CVE-2012-2330 entry affects Node.js, where the Update method in src/node_http_parser.cc fails to properly check string length in versions prior to 0.6.17 and 0.7 prior to 0.7.8. This could allow remote attackers to read sensitive request header contents and potentially spoof HTTP headers via ...
CVE-2012-2330
The Update method in src/nodehttpparser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain sensitive information request header contents and possibly spoof HTTP headers via a zero length string...