1264 matches found
expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate
A use-after-free flaw was found in the Expat package, caused by destruction of a shared DTD in XMLExternalEntityParserCreate in out-of-memory situations. This may lead to availability disruptions...
Wipermania: An All You Can Wipe Buffet
Wipermania: An All You Can Wipe Buffet By Trellix · November 15, 2022 This blog was written by Max Kersten In early 2022, Ukrainian companies were struck by multiple destructive wipers, attacking various organizations across sectors. This raised questions about the usage and impact of “digital...
CVE-2022-41874
Tauri is a framework for building binaries for all major desktop platforms. In versions prior to 1.0.7 and 1.1.2, Tauri is vulnerable to an Incorrectly-Resolved Name. Due to incorrect escaping of special characters in paths selected via the file dialog and drag and drop functionality, it is...
Design/Logic Flaw
Tauri is a framework for building binaries for all major desktop platforms. In versions prior to 1.0.7 and 1.1.2, Tauri is vulnerable to an Incorrectly-Resolved Name. Due to incorrect escaping of special characters in paths selected via the file dialog and drag and drop functionality, it is...
CLSA-2022-1667493762 expat: Fix of CVE-2022-43680
CVE-2022-43680: Fix overeager DTD destruction...
PT-2022-24929 · Metabase · Metabase
Name of the Vulnerable Software and Affected Versions: Metabase versions prior to 0.41.9, 0.42.6, 0.43.7, 0.44.5, 1.41.9, 1.42.6, 1.43.7, and 1.44.5 Description: The issue allows Remote Code Execution RCE in Metabase, a data visualization software, when users can write SQL queries on H2 databases...
mysql: Server: DDL unspecified vulnerability (CPU Oct 2021)
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DDL. Supported versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...
The vulnerability of the RTKVHD64.sys driver from the Realtek High-Definition Audio (HDA) sound driver package allows a hacker to cause a service failure.
The vulnerability of the RTKVHD64.sys driver in the Realtek High-Definition Audio HDA sound driver package for Lenovo laptops is related to operations that go beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause system failures...
mysql: Server: DDL unspecified vulnerability (CPU Apr 2022)
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DDL. Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...
UBUNTU-CVE-2022-40152
Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks DOS if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...
PT-2022-23112
Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.10.0 TensorFlow versions 2.9.1 and earlier TensorFlow versions 2.8.1 and earlier TensorFlow versions 2.7.2 and earlier Description The issue occurs when mlir::tfg::ConvertGenericFunctionToFunctionDef is given emp...
PT-2022-25251 · Xstream · Xstream
Name of the Vulnerable Software and Affected Versions: Xstream affected versions not specified Description: The issue allows for Denial of Service attacks when the parser is running on user-supplied input. An attacker may supply content that causes the parser to crash by stackoverflow, supporting...
PT-2022-25249 · Xstream · Xstream
Name of the Vulnerable Software and Affected Versions: Xstream affected versions not specified Description: The issue allows an attacker to cause a denial of service attack by supplying content that causes the parser to crash by stack overflow when the parser is running on user-supplied input. Th...
The vulnerability of the webapps component of the server container in Eclipse Jetty allows a hacker to gain unauthorized access to protected information.
The vulnerability of the webapps component of the server container in Eclipse Jetty is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...
The vulnerability of the ActiveX control on SCADA servers of Measuresoft ScadaPro Server and ScadaPro Server Client allows attackers to enhance their privileges.
The vulnerability of the ActiveX control used by SCADA servers of Measuresoft ScadaPro Server and ScadaPro Server Client is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...
The vulnerability of the ActiveX control on SCADA servers of Measuresoft ScadaPro Server and ScadaPro Server Client allows attackers to enhance their privileges.
The vulnerability of the ActiveX control used by SCADA servers of Measuresoft ScadaPro Server and ScadaPro Server Client is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...
GO-2022-0942 Infinite recursion in parser in github.com/graphql-go/graphql
graphql-go aka GraphQL for Go has infinite recursion in the type definition parser...
graphql-go has infinite recursion in the type definition parser
graphql-go aka GraphQL for Go through 0.8.0 has infinite recursion in the type definition parser...
