15892 matches found
Adobe InDesign out-of-bounds write vulnerability (CNVD-2022-48767)
An out-of-bounds write vulnerability exists in Adobe InDesign, a set of typesetting and editing applications from Adobe. An attacker could use this vulnerability to execute arbitrary code in the context of the current user...
GHSA-W3VW-CCC5-QR8V Use After Free in Context::start_auth_session
Impact This issue only applies to applications starting authorization sessions using an explicit initial nonce. When Context::startauthsession was called with a nonce argument value of Some..., the nonce pointer passed down through FFI to EsysStartAuthSession would be a dangling pointer, left ove...
The vulnerability of the Attachments/File Upload sub-component of the Oracle Applications Framework in the Oracle E-Business Suite allows a perpetrator to modify data or gain unauthorized access to protected information.
The vulnerability of the Attachments/File Upload sub-component of the Oracle Applications Framework in the Oracle E-Business Suite exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker, operating remotely, to modify data or gain unauthorized access ...
7 Key Findings from the 2022 SaaS Security Survey Report
The 2022 SaaS Security Survey Report, in collaboration with CSA, examines the state of SaaS security as seen in the eyes of CISOs and security professionals in today’s enterprises. The report gathers anonymous responses from 340 CSA members to examine not only the growing risks in SaaS security b...
MINMAX SQL Injection Vulnerability
MINMAX is a high power density 10W DC-DC converter for space-critical applications from China-based MINMAX. MINMAX is vulnerable to SQL injection, which can be exploited by attackers to cause a sql injection issue through manipulation of the id parameter in /newsDia.php...
SAP 3D Visual Enterprise Viewer Input Validation Error Vulnerability (CNVD-2022-50934)
SAP 3D Visual Enterprise Viewer is a 3D view viewer from SAP Germany. The software supports publishing 2D and 3D scenes in all industry-standard desktop applications and supports separate installations as standalone executables and ActiveX spaces. The vulnerability can be exploited to crash the...
Siemens Mendix SAML Module跨站脚本漏洞
The Mendix SAML Module allows authentication of users in cloud applications using SAML. The module can communicate with any identity provider that supports SAML 2.0 or Shibboleth. A cross-site scripting vulnerability exists in Siemens Mendix SAML Module, which can be exploited by attackers to...
SUSE: Security Advisory (SUSE-SU-2022:2072-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SAP 3D Visual Enterprise Viewer Input Validation Error Vulnerability (CNVD-2022-50939)
SAP 3D Visual Enterprise Viewer is a 3D view viewer from SAP Germany. The software supports publishing 2D and 3D scenes in all industry-standard desktop applications and supports separate installations as standalone executables and ActiveX spaces. The vulnerability can be exploited to crash the...
The vulnerability of the Application Service component of the software for working with Oracle Web Applications Desktop Integrator allows a perpetrator to gain access to modify, add, or delete data, or to gain unauthorized access to protected information.
The vulnerability of the Application Service component of the Oracle Web Applications Desktop Integrator software exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data, or gain unauthorized...
What is the Essential Eight (And Why Non-Aussies Should Care)
In 2017, The Australian Cyber Security Center ACSC published a set of mitigation strategies that were designed to help organizations to protect themselves against cyber security incidents. These strategies, which became known as the Essential Eight, are designed specifically for use on Windows...
Samsung mobile DisplayToast Information Disclosure Vulnerability (CNVD-2022-67286)
Samsung mobile is a cell phone from Samsung South Korea. Samsung mobile DisplayToast is vulnerable to information disclosure. The vulnerability stems from an unprotected broadcast in sendIntentForToastDumpLog in DisplayToast, which could be exploited to allow untrusted applications to access toas...
Design/Logic Flaw
Electron is a framework for writing cross-platform desktop applications using JavaScript JS, HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows attackers who have control over a given apps update server / update storage to serve maliciously crafte...
CVE-2022-29247
Electron is a framework for writing cross-platform desktop applications using JavaScript JS, HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with nodeIntegrationInSubFrames...
SUSE: Security Advisory (SUSE-SU-2022:2035-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
People’s Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices
Summary Best Practices • Apply patches as soon as possible • Disable unnecessary ports and protocols • Replace end-of-life infrastructure • Implement a centralized patch management system This joint Cybersecurity Advisory describes the ways in which People’s Republic of China PRC state-sponsored...
Embedthis Software Appweb Community Edition Denial of Service Vulnerability
Embedthis Software Appweb is a web server for embedded applications from Embedthis Software, Inc. A denial of service vulnerability exists in Embedthis Software Appweb Community Edition version 8.2.1, which originates in src/ http/http/httpLib.c, an attacker can use this vulnerability to crash th...
Taming the Digital Asset Tsunami
Internet Protocol IP addresses and the devices, web services and cloud assets behind them are the lifeblood of modern businesses. But too often companies amass thousands of digital assets, creating an unmanageable mess for IT and security teams. Left unchecked, a single forgotten, abandoned or...