Apache Apisix Information Disclosure Vulnerability

Apache Apisix is a cloud-native microservices API gateway service from the Apache Foundation. The software is based on OpenResty and etcd and features dynamic routing and plugin hot-loading for API management in microservices systems. versions prior to Apache Apisix 2.13.1 contain an information...

The vulnerability of the interactive graphical SCADA system, Interactive Graphical SCADA System (IGSS), arises from overflowing buffers in the dynamic memory, allowing a intruder to trigger a service failure or execute arbitrary code.

The vulnerability of the interactive graphical SCADA system, Interactive Graphical SCADA System IGSS, arises due to overflow in the buffer of dynamic memory. Exploiting this vulnerability allows a malicious actor to cause service failures or execute arbitrary code using specially created messages...

Samsung Telecom licensing issue vulnerability

Samsung Telecom is a communication feature for Samsung Samsung mobile devices. Samsung Telecom suffers from an authorization issue vulnerability that stems from a lack of proper privileges for dynamic receivers in Telecom, which could be exploited by an attacker to launch arbitrary activity...

CVE-2022-27527

A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files. It was fixed in PDFTron earlier than 9.0.7 version in Autodesk Navisworks 2022, and 2020...

Autodesk Navisworks 缓冲区错误漏洞

Autodesk Navisworks is 3D model review software for architecture, engineering, and construction from Autodesk, Inc. A buffer error vulnerability exists in Autodesk Navisworks 9.0.7 in Autodesk Navisworks 2022, which stems from a memory corruption vulnerability that could lead to code execution vi...

[SECURITY] Fedora 35 Update: dhcp-4.4.3-2.fc35

DHCP Dynamic Host Configuration Protocol...

Security Bulletin: IBM Informix Dynamic Server is vulnerable to denial of service (CVE-2021-45105) and remote code execution (CVE-2021-45046) due to Apache Log4j

Summary There is a vulnerability in the Apache Log4j open source library used by IBM Informix Dynamic Server for IBM Informix HQ. IBM Informix Dynamic Server is vulnerable to denial of service CVE-2021-45105 and remote code execution CVE-2021-45046 due to Apache Log4j. The fix is included in Apac...

The vulnerability of the FortiOS operating system’s signature verification function allows a hacker to execute arbitrary code.

The vulnerability of the FortiOS operating system’s signature verification function is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using specially created installation images...

CVE-2022-29047

Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a4ebbe039 and earlier, except 2.21.3, allows attackers able to submit pull requests or equivalent, but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamicall...

CVE-2022-29047

Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a4ebbe039 and earlier, except 2.21.3, allows attackers able to submit pull requests or equivalent, but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamicall...

CVE-2022-29047

Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a4ebbe039 and earlier, except 2.21.3, allows attackers able to submit pull requests or equivalent, but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamicall...

CVE-2022-23449

A vulnerability has been identified in SIMATIC Energy Manager Basic All versions V7.3 Update 1, SIMATIC Energy Manager PRO All versions V7.3 Update 1. A DLL Hijacking vulnerability could allow a local attacker to execute code with elevated privileges by placing a malicious DLL in one of the...

The vulnerability of Adobe After Effects’ video and dynamic image editing software lies in its ability to read data beyond the buffer in memory, allowing attackers to gain unauthorized access to protected information.

The vulnerability of Adobe After Effects video and dynamic image editing software relates to reading beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

WordPress plugin 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2022-6500 · Dji · Dji Spark

Name of the Vulnerable Software and Affected Versions: DJI Spark version 01.00.0900 Description: The issue is related to a flaw in the implementation of the Dynamic Host Configuration Protocol DHCP in the DJI Spark drone's firmware, which can lead to the exhaustion of the IP address pool due to a...

Jenkins Pipeline访问控制错误漏洞

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins Pipeline is a suite of plugins that support the implementation and integration of continuous delivery pipelines int...

CVE-2022-27843

DLL hijacking vulnerability in Kies prior to version 2.6.4.220142 allows attacker to execute abitrary code...

Mozilla: Incorrect AliasSet used in JIT Codegen

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as: When generating the assembly code for MLoadTypedArrayElementHole, an incorrect AliasSet was used. In conjunction with another vulnerability, this could have been used for an out-of-bounds memory read...

Mozilla: Incorrect AliasSet used in JIT Codegen

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as: When generating the assembly code for MLoadTypedArrayElementHole, an incorrect AliasSet was used. In conjunction with another vulnerability, this could have been used for an out-of-bounds memory read...

7 Rapid Questions: Meet Adrian Stewart, Aspiring Pilot Turned Product Manager

Welcome back to 7 Rapid Questions, our blog series where we ask passionate leaders at Rapid7 how they’re challenging convention and making an impact. In this installment, we talk to Adrian Stewart, a product manager working on InsightAppSec, Rapid7’s dynamic application security testing DAST tool...