CVE-2022-28764 Local information exposure in Zoom Clients

The Zoom Client for Meetings for Android, iOS, Linux, macOS, and Windows before version 5.12.6 is susceptible to a local information exposure vulnerability. A failure to clear data from a local SQL database after a meeting ends and the usage of an insufficiently secure per-device key encrypting...

CVE-2021-44862 Sensitive Information store in NSClient logs

Netskope client is impacted by a vulnerability where an authenticated, local attacker can view sensitive information stored in NSClient logs which should be restricted. The vulnerability exists because the sensitive information is not masked/scrubbed before writing in the logs. A malicious user c...

MGASA-2022-0382 Updated epiphany packages fix security vulnerability

In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow in ephystringshorten in the UI process via a long page title. The issue occurs because the number of bytes for a UTF-8 ellipsis character is not properly considered. CVE-2022-29536...

TP-LINK AX10 信任管理问题漏洞

The TP-LINK AX10 is a router from China P&L TP-LINK. A security vulnerability exists in the TP-LINK AX10 version V12111117, which originates from the use of hard-coded encryption keys by web application clients when communicating with the router. An attacker could use this vulnerability to obtain...

Microsoft Windows DHCP Client 安全漏洞

Microsoft Windows is a set of operating systems for personal devices from Microsoft Corporation USA.An elevation of privilege vulnerability exists in Microsoft Windows DHCP Client, which stems from improper privilege assignment in the application and can be exploited by an attacker to cause an...

Microsoft Windows Point-to-Point Tunneling Protocol 竞争条件问题漏洞

Microsoft Windows Point-to-Point Tunneling Protocol PPTP is a network protocol from Microsoft that enables the secure transmission of data from remote clients to private corporate servers by creating a virtual private network VPN over a TCP/IP-based data network. VPN. A competitive conditions iss...

CVE-2022-23678

A vulnerability in the Aruba Virtual Intranet Access VIA client for Microsoft Windows operating system client communications that could allow for an attacker in a privileged network position to intercept sensitive information in Aruba Virtual Intranet Access VIA client for Microsoft Windows...

CVE-2021-44718

wolfSSL through 5.0.0 allows an attacker to cause a denial of service and infinite loop in the client component by sending crafted traffic from a Machine-in-the-Middle MITM position. The root cause is that the client module accepts TLS messages that normally are only sent to TLS servers...

AZL-10529 CVE-2022-1705 affecting package golang for versions less than 1.18.5-1

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid...

IBM Spectrum Protect 安全漏洞

IBM Spectrum Protect is a suite of data protection platforms from IBM USA. The platform provides enterprises with a single point of control and management, and supports backup and recovery for virtual, physical and cloud environments of all sizes. IBM Spectrum Protect Client has an information...

The vulnerability of clients for conducting real-time audio and video conferences via Zoom Client for Meetings on Android, iOS, Linux, macOS, and Windows allows a perpetrator to disclose protected information.

The vulnerability of clients for conducting real-time audio and video conferences using Zoom Client for Meetings on Android, iOS, Linux, macOS, and Windows involves the disclosure of information. Exploiting this vulnerability can allow a malicious actor to disclose the protected information...

CVE-2021-3779

A malicious MySQL server can request local file content from a client using ruby-mysql prior to version 2.10.0 without explicit authorization from the user. This issue was resolved in version 2.10.0 and later...

google-oauth-client: Token signature not verified

A flaw was found in Google OAuth Java client's IDToken verifier, where it does not verify if the token is properly signed. This issue could allow an attacker to provide a compromised token with a custom payload that will pass the validation on the client side, allowing access to information outsi...

CVE-2022-31031 Potential stack buffer overflow when parsing message as a STUN client

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions prior to and including 2.12.1 a stack buffer overflow vulnerability affects PJSIP users that use STUN in their...

GHSA-JF99-2RJ4-JXRM Transifex command-line client has improper certificate validation

Transifex command-line client before 0.10 does not validate X.509 certificates for data transfer connections, which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2073...

The vulnerability of the AWS VPN Client service, related to the disclosure of information, allows a perpetrator to expose the protected information.

The vulnerability of the AWS VPN Client relates to the exposure of information. Exploiting this vulnerability could allow a malicious actor to disclose protected information using a specially created malicious configuration file named ovpn...

F5 BIG-IP APM 安全漏洞

F5 BIG-IP APM Edge Client for Windows is a client-side access control authentication access client application from F5. A security vulnerability exists in F5 BIG-IP APM Edge Client for Windows, which can be exploited by attackers to obtain privilege escalation on client Windows systems...

CVE-2022-21716 Buffer Overflow in Twisted

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach...

[SECURITY] [DLA 2919-1] python2.7 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2919-1 [email protected] https://www.debian.org/lts/security/ Anton Gladky February 12, 2022 https://wiki.debian.org/LTS -...

CVE-2021-36349

Dell EMC Data Protection Central versions 19.5 and prior contain a Server Side Request Forgery vulnerability in the DPC DNS client processing. A remote malicious user could potentially exploit this vulnerability, allowing port scanning of external hosts...