UBUNTU-CVE-2022-31739

When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths that used variables such as %HOMEPATH% or %APPDATA%.This bug only affects Firefox for Windows. Other operating systems are unaffected.. This...

PT-2022-5320 · Microsoft +1 · Dbghelp.Dll +1

Name of the Vulnerable Software and Affected Versions: Redis affected versions not specified Description: A critical vulnerability was found in a port or fork of Redis, affecting the dbghelp.dll library. The issue is related to an uncontrolled search path, which can be exploited remotely. The...

UBUNTU-CVE-2022-39427

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.40. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...

PT-2022-5178 · Oracle · Oracle Database Server

Name of the Vulnerable Software and Affected Versions: Oracle Database Server version 19c Description: The issue exists due to insufficient protection of the web page structure in the Oracle Services for Microsoft Transaction Server component. This allows a remote attacker to potentially gain rea...

PT-2022-5949 · Oracle +1 · Virtualbox +1

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.40 Description: The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, which can be exploited by a low-privileged attacker with logon access to the...

PT-2022-25191 · Hertz · Hertz

Name of the Vulnerable Software and Affected Versions: Hertz versions prior to 0.3.1 Description: The issue is related to a path traversal vulnerability via the normalizePath function. This vulnerability is caused by improper path sanitization on Windows, which permits path traversal attacks...

UBUNTU-CVE-2022-21491

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.34. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...

Oracle VM VirtualBox 输入验证错误漏洞

Oracle VM VirtualBox is a virtual machine management software from Oracle Corporation. Oracle Virtualization Oracle VM VirtualBox suffers from an input validation error vulnerability that allows a low-privileged attacker to compromise Oracle VM VirtualBox by logging on to the infrastructure that...

CVE-2022-21221

The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. Note: This security issue impacts Windows users only...

PT-2022-2012 · Oracle +1 · Virtualbox +1

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.32 Description: The issue allows a low-privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox, potentially impacting additional...

CVE-2021-38492

When delegating navigations to the operating system, Firefox would accept the mk scheme which might allow attackers to launch pages and execute scripts in Internet Explorer in unprivileged mode. This bug only affects Firefox for Windows. Other operating systems are unaffected.. This vulnerability...

CVE-2020-26966

Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting of that string; resulting in an information leak. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This...

CVE-2020-15663

If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges. Although the Mozilla Maintenance Service does ensure that updater.exe is signed by Mozilla, the version could have been rolled back to ...

CVE-2020-15657

Firefox could be made to load attacker-supplied DLL files from the installation directory. This required an attacker that is already capable of placing files in the installation directory. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This...

CVE-2019-17015

During the initialization of a new content process, a pointer offset can be manipulated leading to memory corruption and a potentially exploitable crash in the parent process. Note: this issue only occurs on Windows. Other operating systems are unaffected.. This vulnerability affects Firefox ESR...

CVE-2019-17009

When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. Note: This attack requires local system access and only affects Windows. Other...

UBUNTU-CVE-2019-17009

When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. Note: This attack requires local system access and only affects Windows. Other...

PSKernel-Primitives

This repository, zdiskless/PSKernel-Primitives, is a collection of PowerShell primitives for exploitation. The code includes various functions for generating shellcode, allocating memory, and interacting with the Windows kernel. The functions in this repository are designed to be used in...

CVE-2019-11753

The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unprivileged users or malware. If the Mozilla Maintenance Service is manipulated to update this unprotected location and the updated maintenance service in the...

CVE-2019-11736

The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the Maintenance Service executable, which is run with privileged access. Additionally, there was a race condition during...