748 matches found
CVE-2022-20358
In startSync of AbstractThreadedSyncAdapter.java, there is a possible way to access protected content of content providers due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for...
PT-2022-14584 · Google · Android
Name of the Vulnerable Software and Affected Versions: Android versions Android-10 through Android-12L Description: The issue is related to a missing permission check in the startSync method of AbstractThreadedSyncAdapter.java, which could allow access to protected content of content providers...
Denial Of Service
Open policy agent is vulnerable to Denial of Service. An attacker is able to crash the system via a maliciously crafted inputs via the abstract systax tree parser in ast/compile.go...
UBUNTU-CVE-2022-34476
ASN.1 parsing of an indefinite SEQUENCE inside an indefinite GROUP could have resulted in the parser accepting malformed ASN.1. This vulnerability affects Firefox 102...
CVE-2022-33107
ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\AbstractCache.php. This vulnerability allows attackers to execute arbitrary code via a crafted payload...
Mozilla Firefox 输入验证错误漏洞
Mozilla Firefox is an open source Web browser from the Mozilla Foundation. Mozilla Firefox is vulnerable to an input validation error that stems from a lack of ASN.1 parsing restrictions on error formats. An attacker could exploit this vulnerability to compromise the affected system...
Malicious code in sfdc-abstract-plot (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 054964122d2a8e86e2c0966558d1ae1e8c3e220bcd91770788fa330bf3ed6364 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in sfdc-abstract-chart (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d4fb0d0033264a928716326514774becd436c82d3a722325c147978b06c48fc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-6044 Malicious code in sfdc-abstract-chart (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d4fb0d0033264a928716326514774becd436c82d3a722325c147978b06c48fc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-6045 Malicious code in sfdc-abstract-plot (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 054964122d2a8e86e2c0966558d1ae1e8c3e220bcd91770788fa330bf3ed6364 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-6043 Malicious code in sfdc-abstract-cartesian-chart (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 276c21f96d0fab4f0a31ce90298fee2aa61a7083e79ed54ed72e1d2dc4315c38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in sfdc-abstract-cartesian-chart (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 276c21f96d0fab4f0a31ce90298fee2aa61a7083e79ed54ed72e1d2dc4315c38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CLSA-2022-1654525948 Fixed CVEs in python2-pip-18.module_el8.4.0+2051+0b56c8de: CVE-2021-3733, CVE-2021-3737, CVE-2022-0391, CVE-2021-4189
CVE-2021-3733: urllib: Regular expression DoS in AbstractBasicAuthHandler rhbz2047376 - CVE-2021-3737: urllib: HTTP client possible infinite loop on a 100 Continue response rhbz2047376 - CVE-2021-4189: ftplib should not use the host from the PASV response rhbz2047376 - CVE-2022-0391: urllib.parse...
BinAbsInspector - Vulnerability Scanner For Binaries
BinAbsInspector Binary Abstract Inspector is a static analyzer for automated reverse engineering and scanning vulnerabilities in binaries, which is a long-term research project incubated at Keenlab. It is based on abstract interpretation with the support from Ghidra. It works on Ghidra's Pcode...
DEBIAN-CVE-2021-3733
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client such as web browser connects to, could trigger a Regular Expression Denial of Service ReDOS during an authentication request with a specially crafted payload that is sen...
Design/Logic Flaw
OPA is an open source, general-purpose policy engine. Under certain conditions, pretty-printing an abstract syntax tree AST that contains synthetic nodes could change the logic of some statements by reordering array literals. Example of policies impacted are those that parse and compare web paths...
Open Policy Agent 安全漏洞
Open Policy Agent is an open source general-purpose policy engine that enables uniform, context-aware policy enforcement across the stack. Open Policy Agent suffers from a security vulnerability that stems from the fact that under certain conditions, pretty-printing an Abstract Syntax Tree AST...
CLSA-2021-1639681783 Fix CVE(s): CVE-2021-3712
SECURITY UPDATE: fix assumption that ASN.1 string is NULL terminated when it exactly doesn't. - debian/patches/CVE-2021-3712.patch: backport all found cases where code relayed on assumtion that ASN.1 string is NULL terminated - CVE-2021-3712...
openssl: Read buffer overruns processing ASN.1 strings
It was found that openssl assumed ASN.1 strings to be NUL terminated. A malicious actor may be able to force an application into calling openssl function with a specially crafted, non-NUL terminated string to deliberately hit this bug, which may result in a crash of the application, causing a...
