SUSE CVE-2017-1000050

JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2encode which failed to check to see if the image contained at least one component resulting in a denial-of-service...

SUSE CVE-2018-4323

Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7...

SUSE CVE-2018-6954

systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors involving creation of a directory and a file under that directory, and later replacing that directory with a symlink. Th...

SUSE CVE-2018-7175

An issue was discovered in xpdf 4.00. A NULL pointer dereference in readCodestream allows an attacker to cause denial of service via a JPX image with zero components...

SUSE CVE-2018-20822

LibSass 3.5.4 allows attackers to cause a denial-of-service uncontrolled recursion in Sass::ComplexSelector::perform in ast.hpp and Sass::Inspect::operator in inspect.cpp...

SUSE CVE-2019-6233

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution...

SUSE CVE-2019-8707

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web content may lead to arbitrary code execution...

SUSE CVE-2019-8733

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web content may lead to arbitrary code execution...

@adelosrios/plugin-dependencytrack (>=0.2.8 <=0.2.9), @apresti12/plugin-argocd-autopilot (=0.2.1) +184 more potentially affected by CVE-2023-25571 via @backstage/core-components (>=0.0.0-nightly-20220310022859 <=0.11.2)

@backstage/core-components NPM version =0.0.0-nightly-20220310022859, =0.2.8, =0.1.3, =0.0.0-nightly-2022122206, =0.0.0-nightly-2021533445, =0.0.0-nightly-20240929023448, =0.0.0-nightly-20230927021302, =0.0.0-nightly-20251125024456, =0.0.0-nightly-2021242250, =0.0.0-nightly-20231223021142,...

backstage 跨站脚本漏洞

backstage is an application. Backstage is an open platform for building developer portals. A security vulnerability exists in backstage catalog-model prior to 1.2.0, backstage core-components prior to 0.12.4, and backstage plugin-catalog-backend prior to 1.7.2 that originates from a vulnerability...

Typosquatting: Legit Abquery Package Duped with Malicious Aabquerys

By Deeba Ahmed Aabquerys use the typosquatting technique to encourage downloading malicious components, as it has been cleverly named to make it sound like the legitimate NPM module Abquery. This is a post from HackRead.com Read the original post: Typosquatting: Legit Abquery Package Duped with...

Fedora 37 : php-symfony4 (2023-74b702f058)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-74b702f058 advisory. Version 4.4.50 2023-02-01 security cve-2022-24895 Security/Http Remove CSRF tokens from storage on successful login nicolas-grekas security...

CVE-2022-46675

Wyse Management Suite Repository 3.8 and below contain an information disclosure vulnerability. A unauthenticated attacker could potentially discover the internal structure of the application and its components and use this information for further vulnerability research...

Security Bulletin: Vulnerability in IBM Java Runtime affect SPSS Collaboration and Deployment Services (CVE-2022-3676)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Version 7 & 8 used by SPSS Collaboration and Deployment Services. This issue has been addressed. Vulnerability Details CVEID:CVE-2022-3676 DESCRIPTION: Eclipse Openj9 could allow a remote attacker to bypass security restrictions,...

The vulnerabilities of Redfish components and the API of microprogramming software for AMI MegaRAC controllers allow a perpetrator to gain unauthorized access to protected information.

The vulnerability of Redfish components and the API of microprogramming software for AMI MegaRAC controllers is related to insufficient calculation of password hashes. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

Vulnerabilities fixed in Google Android and Samsung Mobile

Google has fixed vulnerabilities in Android. Also fixed vulnerabilities in closed-source parts of Android that are developed by third parties, such as Qualcomm, Unisoc and Mediatek. The vulnerabilities potentially enable a malicious party to perform attacks that result in the following categories...

CVE-2022-48019

The components wfshbr64.sys and wfshbr32.sys in Another Eden before v3.0.20 and before v2.14.200 allows attackers to perform privilege escalation via a crafted payload...

MAL-2023-814 Malicious code in stats-collect-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad3d02771bbae32c6827b2d78a02c6a6f23d67fca38cc7361fdcd739f0ee4398 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in stats-collect-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad3d02771bbae32c6827b2d78a02c6a6f23d67fca38cc7361fdcd739f0ee4398 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-34459

Dell Command | Update, Dell Update, and Alienware Update versions prior to 4.7 contain a improper verification of cryptographic signature in get applicable driver component. A local malicious user could potentially exploit this vulnerability leading to malicious payload execution...