Nextcloud: nextcloudcmd incorrectly trusts bad TLS certificates

Ref: https://github.com/nextcloud/desktop/issues/4927 Bug description I have a self hosted Nextcloud instance using my own private CA for TLS certs. When running nextcloudcmd without the --trust, it disregards the cert validation failure as "This is not an actual error" and proceeds with the sync...

Adobe Acrobat Reader DC 资源管理错误漏洞

Adobe Acrobat Reader DC is the United States of America Audobee Adobe company of a Pdf reading tool. It is used to reliably view, print and annotate Pdf documents. A resource management error vulnerability exists in Adobe Acrobat Reader DC, which arises from failure to validate the object of an...

SAMSUNG Mobile devices 缓冲区错误漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from the South Korean company Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Mobile devices SEM TA Module SMR Aug-2022 Release 1 prior to Release 1, which stems from a lack of input...

Lack of Maximum Characters Length Validation on `Assignment Title` Input

Hello, Description The Assignment Title input is not being validated against a large number of characters added in it's value. This allows to initiate large number of characters and very big text inside the page. Proof of Concept 1. Navigate to Assignments section:...

The vulnerability of the Billing Care component of Oracle Communications’ Billing and Revenue Management software allows a perpetrator to execute arbitrary codes.

The vulnerability of the Billing Care component of Oracle Communications’ Billing and Revenue Management software exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

National Health Insurance 安全漏洞

National Health Insurance NHI is a health insurance program health insurance card in Taiwan, China. A security vulnerability exists in National Health Insurance that stems from insufficient validation of network packet header lengths and a stack-based buffer overflow, which could be exploited by ...

CVE-2022-32961

HICOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insufficient parameter length validation for token information. An unauthenticated physical attacker can exploit this vulnerability to execute arbitrary code,...

PT-2022-7283 · Xpdf +1 · Xpdf +1

Name of the Vulnerable Software and Affected Versions: Xpdf version 4.0.4 Description: The issue exists due to insufficient input validation in the /xpdf/AcroForm.cc:538 component of the Xpdf software, which can lead to a segmentation violation. Exploitation of this issue may allow an attacker to...

CVE-2022-20221

In avrcctrlparsvendorcmd of avrcparsct.cc, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2022-29560

A vulnerability has been identified in RUGGEDCOM ROX MX5000 All versions 2.15.1, RUGGEDCOM ROX MX5000RE All versions 2.15.1, RUGGEDCOM ROX RX1400 All versions 2.15.1, RUGGEDCOM ROX RX1500 All versions 2.15.1, RUGGEDCOM ROX RX1501 All versions 2.15.1, RUGGEDCOM ROX RX1510 All versions 2.15.1,...

The vulnerability of the Core server component of Oracle WebLogic Server allows a attacker to trigger a service failure.

The vulnerability of the Core server component of Oracle WebLogic Server is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service interruptions using network T3/IIOP protocols...

The vulnerability of the Core component in Oracle VM VirtualBox allows a hacker to gain access to data read by the system.

The vulnerability of the Core component in Oracle VM VirtualBox exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to and read data...

The vulnerability of the Oracle XML DB component of the Oracle Database Server system allows a perpetrator to gain unauthorized access to critical data.

The vulnerability of the Oracle XML DB component of the Oracle Database Server management system exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to critical data or full access to all available data in the Oracle...

Online Fire Reporting System 跨站脚本漏洞

Online Fire Reporting System is an online fire reporting system from Carlo Montero's personal developer. Online Fire Reporting System v1.0 is vulnerable to a cross-site scripting vulnerability that originates in /ofrs/classes/Master.php due to a lack of data validation of user-supplied The...

CVE-2022-28217

Some part of SAP NetWeaver EP Web Page Composer does not sufficiently validate an XML document accepted from an untrusted source, which allows an adversary to exploit unprotected XML parking at endpoints, and a possibility to conduct SSRF attacks that could compromise system�s Availability by...

Wedding Management System SQL注入漏洞

Wedding Management System is a wedding planning management system by John Paul Lim Gabule, a personal developer. v1.0 of Wedding Management System is vulnerable to SQL injection, which originates from the admin/packageedit.php page that lacks The vulnerability is caused by a lack of validation of...

GHSA-5V77-J66X-4C4G Missing validation causes denial of service via `Conv3DBackpropFilterV2`

Impact The implementation of tf.rawops.Conv3DBackpropFilterV2 does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf tf.rawops.Conv3DBackpropFilterV2 input=tf.constant.5053710941,...

GHSA-C4WX-3X5Q-HF4W Subrion CMS Cross-Site Request Forgery (CSRF) vulnerability

A Cross-Site Request Forgery CSRF vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the server without a victim's knowledge, by enticing an authenticated user to visit an attacker's web page. The application fails to validate the CSRF token for a G...

Zoo Management System 跨站脚本漏洞

A cross-site scripting vulnerability exists in Zoo Management System version 1.0, a zoo management system. The vulnerability stems from a lack of data validation filtering of user-supplied data and output by adminname. An attacker could exploit this vulnerability to execute JavaScript code on the...

CVE-2022-29198 Missing validation causes denial of service in TensorFlow via `SparseTensorToCSRSparseMatrix`

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of tf.rawops.SparseTensorToCSRSparseMatrix does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service...