log4j: Unsafe deserialization flaw in Chainsaw log viewer

A flaw was found in the log4j 1.x chainsaw component, where the contents of certain log entries are deserialized and possibly permit code execution. This flaw allows an attacker to send a malicious request with serialized data to the server to be deserialized when the chainsaw component is run...

log4j: Unsafe deserialization flaw in Chainsaw log viewer

A flaw was found in the log4j 1.x chainsaw component, where the contents of certain log entries are deserialized and possibly permit code execution. This flaw allows an attacker to send a malicious request with serialized data to the server to be deserialized when the chainsaw component is run...

PT-2022-5340 · Corel · Coreldraw Graphics Suite

Name of the Vulnerable Software and Affected Versions: CorelDRAW Graphics Suite version 23.5.0.506 Description: The issue is related to a read past the end of an allocated object when parsing PDF files, due to the lack of proper validation of user-supplied data. This can allow an attacker to...

Vulnerabilities fixed in F5 products

F5 has fixed multiple vulnerabilities in several F5 products, including BIG-IP and BIG-IQ. Most of the updates are relate to the Traffic Management Microkernel TMM, a component of virtually all BIG-IP modules. The vulnerability with reference CVE-2022-23008 concerns the NGINX Controller API...

CVE-2022-23307 A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists...

OPENSUSE-SU-2021:1640-1 Security update for c-toxcore

c-toxcore was updated fo fix a securiy issue: - CVE-2021-44847: Fixed a buffer overflow in handlerequest in DHT.c which could lead to remote DoS and potential code execution boo1193667...

ROS-2-1855

2.1855 Vulnerability in Mozilla Thunderbird email client CVE-2021-29970, CVE-2021-30547, CVE-2021-29976, CVE-2021-29969. 1. Vulnerability Description: CVE-2021-29970 Vulnerability in Mozilla Thunderbird email client, related to HTML content processing error. Exploitation of the vulnerability coul...

PT-2021-22892 · R3D Sdk +1 · R3D Sdk +1

Name of the Vulnerable Software and Affected Versions: DPDecoder service affected versions not specified Description: The issue arises when the DPDecoder service parses a submitted file as a job, using decoding parameters and fields parsed by the R3D SDK to calculate a heap buffer size. An intege...

PT-2021-7505 · Hirschmann +1 · Hirschmann Bat-C2 +1

Name of the Vulnerable Software and Affected Versions: Lantronix PremierWave 2050 version 8.9.0.0R4 Hirschmann BAT-C2 affected versions not specified Description: A command injection vulnerability exists in the Web Manager Wireless Network Scanner functionality, allowing a specially-crafted HTTP...

CVE-2021-44859

An out-of-bounds read vulnerability exists when reading a TGA file using Open Design Alliance Drawings SDK before 2022.12. The specific issue exists after loading TGA files. An unchecked input data from a crafted TGA file leads to an out-of-bounds read. An attacker can leverage this vulnerability...

UBUNTU-CVE-2021-40826

Clementine Music Player through 1.3.1 is vulnerable to a User Mode Write Access Violation, affecting the MP3 file parsing functionality at clementine+0x3aa207. The vulnerability is triggered when the user opens a crafted MP3 file or loads a remote stream URL that is mishandled by Clementine...

CVE-2021-44228 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Apache Log4j2 2.0-beta9 through 2.15.0 excluding security releases 2.12.2, 2.12.3, and 2.3.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message...

PT-2021-5169

Name of the Vulnerable Software and Affected Versions Apache Log4j2 versions 2.0-beta9 through 2.15.0 Apache Log4j2 version 2.16.0 and later are not affected, as the vulnerable functionality has been completely removed. Description The vulnerability in Apache Log4j2 is related to the JNDI feature...

PT-2021-16708 · Bl31 +1 · Bl31 +1

Name of the Vulnerable Software and Affected Versions: LDFW and BL31 versions prior to SMR Dec-2021 Release 1 Description: The issue is related to an improper boundary check in the secure log of LDFW and BL31, which allows for arbitrary memory write and code execution. Recommendations: For versio...

PT-2021-5651 · Apache +1 · Apache Http Server +6

Name of the Vulnerable Software and Affected Versions: SonicWall SMA 100 Appliances version 10.2.0.8-37sv SonicWall SMA 100 Appliances version 10.2.1.1-19sv SonicWall SMA 100 Appliances version 10.2.1.2-24sv SonicWall SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19s...

USN-5172-1 uriparser vulnerabilities

It was discovered that uriparser mishandled certain input. An attacker could use this vulnerability to cause uriparser to crash or possibly execute arbitrary code. CVE-2018-19198, CVE-2018-19199, CVE-2018-19200 It was discovered that uriparser incorrectly handled certain URIs. An attacker could u...

PT-2021-5412 · Anker · Anker Eufy Homebase 2

Name of the Vulnerable Software and Affected Versions: Anker Eufy Homebase 2 version 2.1.6.9h Description: An out-of-bounds write issue exists in the CMD DEVICE GET SERVER LIST REQUEST functionality of the home security binary, specifically in the recv server device response msg process function...

CVE-2021-42384

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handlespecial function...

The vulnerability of the Cisco Webex Network Recording Player and Cisco Webex Player for Windows and MacOS operating systems stems from insufficient validation of values in Webex recording files. This allows attackers to execute arbitrary code.

The vulnerability of the Cisco Webex Network Recording Player and Cisco Webex Player for Windows and MacOS operating systems is related to insufficient checking of values in Webex recording files. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a malicious AR...

freerdp: improper client input validation for gateway connections allows to overwrite memory

A flaw was found in the FreeRDP client when it fails to validate input data when using gateway connections. This flaw could allow a malicious gateway to send a specially crafted input to a client leading to an out of bounds write in client memory. The highest threat from this flaw is that it coul...