Heap overflow

A heap out of bounds read vulnerability exists in the handling of IPTC data while parsing TIFF images in OpenImageIO v2.3.19.0. A specially-crafted TIFF file can cause a read of adjacent heap memory, which can leak sensitive process information. An attacker can provide a malicious file to trigger...

Google TensorFlow 代码问题漏洞

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A code issue vulnerability exists in Google TensorFlow, which stems from a logical error in the organization of data, where the conversion from char to bool is undefined if the const char array is not 0...

SUSE-SU-2022:4016-1 Security update for rubygem-nokogiri

This update for rubygem-nokogiri fixes the following issues: - CVE-2022-24836: Fixes possibility to DoS because of inefficient RE in HTML encoding. bsc1198408 - CVE-2022-29181: Fixes Improper Handling of Unexpected Data Typesi. bsc1199782...

SUSE-SU-2022:3983-1 Security update for freerdp

This update for freerdp fixes the following issues: - CVE-2022-39282: Fix to init data read by /parallel command line switch. bsc1204258 - CVE-2022-39283: Fix to prevent video channel from reading uninitialized data. bsc1204257...

PT-2022-5512 · Microsoft · Exchange Server

Name of the Vulnerable Software and Affected Versions: Microsoft Exchange Server affected versions not specified Description: The issue exists due to incorrect handling of user data in Microsoft Exchange Server, allowing a remote attacker to conduct a spoofing attack. This can enable an attacker ...

SUSE-SU-2022:3890-1 Security update for rubygem-nokogiri

This update for rubygem-nokogiri fixes the following issues: - CVE-2022-24836: Fixes possibility to DoS because of inefficient RE in HTML encoding. bsc1198408 - CVE-2022-29181: Fixes Improper Handling of Unexpected Data Typesi. bsc1199782...

PT-2022-7394 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.4 Description: The issue is related to the improper neutralization of input data during web page generation, which may allow a remote attacker to execute arbitrary code. Users may be able to create a public RSS fee...

The vulnerability of D-Link DIR878 router’s microprogramming software, related to the lack of measures taken to clean data at the management level, allows a hacker to execute arbitrary code.

The vulnerability of D-Link DIR878 router’s microprogramming software is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using the /bin/proc.cgi parameter...

The vulnerability of the SetNTPServerSettings function in D-Link COVR 1200, 1202, and 1203 router microprogramming systems allows a hacker to execute arbitrary commands.

The vulnerability of the SetNTPServerSettings function in D-Link COVR 1200, 1202, and 1203 router microprogramming systems is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands through t...

USN-5702-2 curl vulnerability

USN-5702-1 fixed a vulnerability in curl. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: Robby Simpson discovered that curl incorrectly handled certain POST operations after PUT operations. This issue could cause applications...

CVE-2022-3639

A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 10.8 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. Improper data handling on branch creation could have been used to trigger high CPU usage...

CVE-2022-3639

A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 10.8 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. Improper data handling on branch creation could have been used to trigger high CPU usage...

CVE-2022-3639

Removed by vendor...

Design/Logic Flaw

Due to the Improper Handling of an Unexpected Data Type in the processing of EVPN routes on Juniper Networks Junos OS and Junos OS Evolved, an attacker in direct control of a BGP client connected to a route reflector, or via a machine in the middle MITM attack, can send a specific EVPN route...

USN-5636-1 sosreport vulnerability

It was discovered that SoS incorrectly handled certain data. An attacker could possibly use this issue to expose sensitive information...

USN-5613-1 vim vulnerabilities

It was discovered that Vim was not properly performing bounds checks when executing spell suggestion commands. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2022-0943 It was discovered that Vim was using freed memory when dealing with regula...

PT-2022-4787 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows versions prior to the fixed version Description: The vulnerability is related to errors in handling input data in the implementation of the TCP/IP protocol in Windows operating systems. This issue allows a remote attacker to execute...

PT-2022-6911 · D Link · D-Link Dap-1325

Name of the Vulnerable Software and Affected Versions: D-Link DAP-1325 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. The specific flaw exists within the handling of XML data...

CVE-2021-40326

Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, mishandle hidden and incremental data in signed documents. An attacker can write to an arbitrary file, and display controlled contents, during signature verification...

CVE-2022-2534

An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab was returning contributor emails due to improper data handling in the Datadog integration...