CVE-2022-32959

The CVE-2022-32959 entry concerns HiCOS’ client-side citizen digital certificate component, which is vulnerable to a stack-based buffer overflow when reading IC card data due to insufficient validation of OS information parameter length. The impact described in the sources is arbitrary code execu...

Hicos Citizen Certificate Client-side Component 缓冲区错误漏洞

Hicos Citizen Certificate Client-side Component is a citizen certificate client-side component. A security vulnerability exists in the Hicos Citizen Certificate Client-side Component that stems from insufficient validation of the length of the parameters of a token message, which can be exploited...

Hicos Citizen Certificate Client-side Component 资源管理错误漏洞

Hicos Citizen Certificate Client-side Component is a citizen certificate client-side component. A security vulnerability exists in the Hicos Citizen Certificate Client-side Component, which can be exploited by an unauthenticated attacker to corrupt memory and execute arbitrary code, manipulate...

IBM Engineering Requirements Quality Assistant Input Validation Error Vulnerability

IBM Engineering Requirements Quality Assistant is a Watson AI-based software from IBM USA used to assist developers in improving the quality of engineering requirements. The application significantly reduces the cost of finding defects, facilitates early detection of requirements errors in the...

PT-2022-21609 · Hicos · Hicos

Name of the Vulnerable Software and Affected Versions: HICOS affected versions not specified Description: The client-side citizen digital certificate component of HICOS has a stack-based buffer overflow issue when reading an IC card, due to insufficient validation of token information parameter...

Hicos Citizen Certificate Client-side Component 安全漏洞

Hicos Citizen Certificate Client-side Component is a citizen certificate client-side component. A security vulnerability exists in the Hicos Citizen Certificate Client-side Component that stems from insufficient validation of parameter lengths for operating system information, which could be...

Security Experts Warn of Two Primary Client-Side Risks Associated with Data Exfiltration and Loss — The Hacker News

Two client-side risks dominate the problems with data loss and data exfiltration: improperly placed trackers on websites and web applications and malicious client-side code pulled from third-party repositories like NPM. Client-side security researchers are finding that improperly placed trackers,...

Azure Storage SDK でのクライアントサイド暗号化におけるパディング オラクル の脆弱性を軽減

本ブログは、Mitigation for Azure Storage SDK Client-Side Encryption Padding Oracle Vulnerability の抄訳版です。最新の情報は原文を参照してください。...

Oracle Java SE 输入验证错误漏洞

Oracle Java SE is an Oracle Corporation Oracle for the development and deployment of Java applications for desktops, servers, and embedded devices and real-time environments. An input validation error vulnerability exists in Oracle Java SE Component: Libraries for Oracle Java SE version 17.0.3.1...

CVE-2021-29799

IBM Engineering Requirements Quality Assistant On-Premises All versions could allow an authenticated user to obtain sensitive information due to improper client side validation. IBM X-Force ID: 203738...

Input validation

IBM Engineering Requirements Quality Assistant On-Premises All versions could allow an authenticated user to obtain sensitive information due to improper client side validation. IBM X-Force ID: 203738...

CVE-2021-29799

IBM Engineering Requirements Quality Assistant On-Premises All versions could allow an authenticated user to obtain sensitive information due to improper client side validation. IBM X-Force ID: 203738...

Mitigation for Azure Storage SDK Client-Side Encryption Padding Oracle Vulnerability

Summary: Google informed Microsoft under Coordinated Vulnerability Disclosure CVD of a padding oracle vulnerability that may affect customers using Azure Storage SDK for Python, .NET, Java client-side encryption CVE-2022-30187. To mitigate this vulnerability, we released a new General Availabilit...

CVE-2022-24692

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The new menu option within the general Parameters page is vulnerable to stored XSS. The attacker can create a menu option, make it visible to every application user, and conduct session hijacking, account takeover, or malicious code...

Mitigation for Azure Storage SDK Client-Side Encryption Padding Oracle Vulnerability

Summary Summary Google informed Microsoft under Coordinated Vulnerability Disclosure CVD of a padding oracle vulnerability that may affect customers using Azure Storage SDK for Python, .NET, Java client-side encryption CVE-2022-30187. To mitigate this vulnerability, we released a new General...

IBM WebSphere Application Server Cross-Site Scripting Vulnerability

IBM WebSphere Application Server WAS is an application server product from IBM in the United States. The product is a platform for JavaEE and Web services applications and is the foundation of the IBM WebSphere software platform. A cross-site scripting vulnerability exists in IBM WebSphere...

Atlassian Jira Transition Scheduler plugin跨站脚本漏洞

Atlassian Jira is a defect tracking management system from Atlassian Australia. The Atlassian Jira Transition Scheduler plugin version 6.5.0 contains a cross-site scripting vulnerability, which stems from the fact that it is easy to store XSS to the creation function via the project name. An...

Synology Calendar Cross-Site Scripting Vulnerability (CNVD-2022-67855)

Synology Calendar is a file protection program from Synology Inc. of Taiwan, China that runs on Synology NAS Network Storage Server devices. A cross-site scripting vulnerability exists in Synology Calendar versions prior to 2.4.5-10930. The vulnerability stems from the program's lack of data...

IBM Engineering Lifecycle Optimization 跨站脚本漏洞

IBM Engineering Lifecycle Optimization ELO is an extension of the Engineering Lifecycle Management ELM portfolio from IBM America. They make it easier to collect and analyze data across the development environment to make better decisions. Automate reporting to ensure that the entire organization...

CVE-2022-30187

creationtimestamp| type| source ---|---|--- 2022-07-13 02:25:48+00:00| seen| https://t.me/cibsecurity/46123 2022-07-18 05:00:00+00:00| seen| https://msrc.microsoft.com/blog/2022/07/mitigation-for-azure-storage-sdk-client-side-encryption-padding-oracle-vulnerability/...