OESA-2022-1548 unzip security update

A utility for unpacking zip files. Security Fixes: A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or cod...

PT-2022-2077 · Qualcomm · Snapdragon

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon versions affected versions not specified Description: The issue is related to errors in data type conversion during the verification of a file's hash segment, potentially allowing an attacker to elevate their privileges...

AZL-44643 CVE-2021-3575 affecting package openjpeg2 2.3.1-12

A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420torgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg...

CVE-2021-3575

A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420torgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg...

DEBIAN-CVE-2021-3575

A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420torgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg...

ALPINE-CVE-2021-3575

A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420torgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg...

The vulnerability of the rendering module of Blink web pages in Google Chrome and Microsoft Edge allows a hacker to execute arbitrary code.

The vulnerability of the rendering module for web pages in Google Chrome and Microsoft Edge browsers is related to type conversion errors. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

CVE-2021-44334

David Brackeen ok-file-formats 97f78ca is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occurs in function okjpgconvertYCbCrtoRGB in "/okjpg.c:513"...

CVE-2021-44334

David Brackeen ok-file-formats 97f78ca is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occurs in function okjpgconvertYCbCrtoRGB in "/okjpg.c:513"...

WordPress WooCommerce Enhanced Ecommerce Analytics Integration with Conversion Tracking plugin <= 3.6.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WooCommerce Enhanced Ecommerce Analytics Integration with Conversion Tracking plugin versions = 3.6.2. Solution Update the WordPress WooCommerce Enhanced Ecommerce Analytics Integration with Conversion Tracking plugin to the...

WordPress WooCommerce Enhanced Ecommerce Analytics Integration with Conversion Tracking plugin <= 3.6.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WooCommerce Enhanced Ecommerce Analytics Integration with Conversion Tracking plugin versions = 3.6.2. Solution Update the WordPress WooCommerce Enhanced Ecommerce Analytics Integration with Conversion...

Gerbv RS-274X aperture macro outline primitive out-of-bounds read vulnerability

Summary An out-of-bounds read vulnerability exists in the RS-274X aperture macro outline primitive functionality of Gerbv 2.7.0 and dev commit b5f1eacd and the forked version of Gerbv commit d7f42a9a. A specially-crafted Gerber file can lead to information disclosure. An attacker can provide a...

WordPress Add Pinterest conversion tags for Pinterest Ads + Site verification plugin <= 1.2.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Add Pinterest conversion tags for Pinterest Ads + Site verification plugin versions = 1.2.2. Solution Update the WordPress Add Pinterest conversion tags for Pinterest Ads + Site verification plugin to...

WordPress Conversion de moneda Woocommerce plugin <= 1.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Conversion de moneda Woocommerce plugin versions = 1.0. Solution No patched version available...

Accusoft ImageGear XWD parser::xwdread_pixmapformat_0_or_1 heap-based buffer overflow vulnerability

Summary A heap-based buffer overflow vulnerability exists in the XWD parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. Tested Versions Accusoft ImageGear 19.10 Product URLs...

Security Bulletin: Multiple IBM MQ vulnerabilities affect IBM Sterling Global Mailbox

Summary IBM MQ is shipped with IBM Sterling Global Mailbox. Multiple vulnerabilities impacts IBM MQ. Remediation is available for the issues. Vulnerability Details CVEID: CVE-2019-4227 DESCRIPTION: IBM MQ 8.0.0.4 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 AMQP Listeners...

GSD-2022-1000183 udf: Fix NULL ptr deref when converting from inline format

udf: Fix NULL ptr deref when converting from inline format This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.96 by commit...

Denial Of Service (DoS)

IBM MQ is vulnerable to denial of service. The vulnerability exists due to an error within the Data Conversion logic...

in unshiftio/url-parse

Description Incorrect conversion of @ in protocol in the href leads to improper validation of hostname. Proof of Concept Url-parse is not able to verify broken protocol. This will allow to bypass hostname validation. parse = require'url-parse' console.logparse"http:@/127.0.0.1" Now imagine if the...

The vulnerability of the XStream Java library for converting objects to XML or JSON format allows attackers to execute arbitrary code. This vulnerability stems from deficiencies in the deserialization mechanism, enabling attackers to execute unauthorized code.

The vulnerability of the XStream library for converting objects to XML or JSON format is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...