CVE-2021-42521

There is a NULL pointer dereference vulnerability in VTK before 9.2.5, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value of libxml2 API 'xmlDocGetRootElement', and try to dereference it. It is unsafe as the return value can be NULL and that NULL pointer...

UBUNTU-CVE-2021-42521

There is a NULL pointer dereference vulnerability in VTK before 9.2.5, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value of libxml2 API 'xmlDocGetRootElement', and try to dereference it. It is unsafe as the return value can be NULL and that NULL pointer...

PYSEC-2022-255

There is a NULL pointer dereference vulnerability in VTK, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value of libxml2 API 'xmlDocGetRootElement', and try to dereference it. It is unsafe as the return value can be NULL and that NULL pointer dereference may...

PYSEC-2022-255

There is a NULL pointer dereference vulnerability in VTK, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value of libxml2 API 'xmlDocGetRootElement', and try to dereference it. It is unsafe as the return value can be NULL and that NULL pointer dereference may...

AVEVA Edge SCADA Uncontrolled Element Command Execution Privilege Escalation

The vulnerability of the AVEVA Edge SCADA system is related to an uncontrolled element in the search process. Exploiting this vulnerability could allow a attacker to execute arbitrary code or increase their privileges...

AVEVA Edge SCADA Uncontrolled Element Command Execution Privilege Escalation

The vulnerability of the AVEVA Edge SCADA system is related to an uncontrolled element in the search process. Exploiting this vulnerability can allow a hacker to execute arbitrary code or increase their privileges...

Security Bulletin: Security vulnerabilities have been identified in IBM® DB2® shipped with IBM System Networking Element Manager (CVE-2013-6747, CVE-2014-0963)

Summary IBM DB2 is shipped as a component of IBM System Networking Element Manager. Information about security vulnerabilities affecting IBM DB2 has been published in a security bulletin. Vulnerability Details Please consult the security bulletin IBM® DB2® is impacted by multiple TLS/SSL security...

Security Bulletin: Potential security vulnerabilities in IBM Java SDK used in IBM System Networking Element Manager

Summary Potential security exposure when using the Java based applications bundled in IBM System Networking Element Manager due to vulnerabilities in Java Software Developer Kits. See Vulnerability Details for CVE IDs. Vulnerability Details IBM System Networking Element Manager is bundled with th...

PT-2022-4346 · Aveva · Aveva Edge

Name of the Vulnerable Software and Affected Versions: AVEVA Edge versions 2020 SP2 Patch 04201.2111.1802.0000 Description: The issue is related to an uncontrolled search path element in the AVEVA Edge SCADA system, which can be exploited to execute arbitrary code or elevate privileges. Remote...

Element Desktop Matrix Protocol Heap Use-After-Free

The vulnerability of the data transmission software via the Matrix protocol in Element Desktop is related to the possibility of using memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a specially created link...

Mozilla Firefox SVG use XSS

The vulnerability of the SVG element implementation in Mozilla Firefox is related to security configuration errors. Exploiting this vulnerability could allow a malicious actor to execute arbitrary JavaScript code remotely...

Podcast: Inside the Hackers’ Toolkit

There is no question that companies are in the sights of would-be criminals looking to exploit them. While companies look at solutions and training to help keep the perimeter secure, the biggest fail point is often the employees, AKA the human element. In this Threatpost podcast, sponsored by...

PT-2022-28213 · Python · Xml.Etree.Elementtree

Name of the Vulnerable Software and Affected Versions: mofh versions prior to 1.0.1 Description: The issue affects the xml.etree.ElementTree module, making the application susceptible to denial-of-service attacks, specifically the Billion Laughs attack and the Quadratic blowup attack. These attac...

CVE-2022-34235: Uncontrolled Search Path Element

Adobe Premiere Elements version 2020v20 and earlier is affected by an Uncontrolled Search Path Element which could lead to Privilege Escalation. An attacker could leverage this vulnerability to obtain admin using an existing low-privileged user. Exploitation of this issue does not require user...

Intel Enpirion Digital Power Configurator code-related vulnerabilities

Intel Enpirion Digital Power Configurator is digital power configuration software from Intel Corporation USA. A security vulnerability exists in Intel Enpirion Digital Power Configurator that originates from an uncontrolled search path element. An attacker could exploit the vulnerability to eleva...

CVE-2022-31175

CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions. The affected packages are...

QEMU: vhost-vsock: missing virtqueue detach on error can lead to memory leak

A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results...

CVE-2021-38410 AVEVA PCS Portal Uncontrolled Search Path Element

AVEVA Software Platform Common Services PCS Portal versions 4.5.2, 4.5.1, 4.5.0, and 4.4.6 are vulnerable to DLL hijacking through an uncontrolled search path element, which may allow an attacker control to one or more locations in the search path...

Four Main Reasons Shoppers Abandon eCommerce Carts

More than just window shopping eCommerce shopping cart abandonment causes brands a sobering USD 18 Billion in annual revenue Forrester Research. While rates differ by device, with mobile and tablet device users most likely to leave before completing their order, nearly 70 percent of shoppers dese...

USN-5525-1: Apache XML Security for Java vulnerability

It was discovered that Apache XML Security for Java incorrectly passed a configuration property when creating specific key elements. This allows an attacker to abuse an XPath Transform to extract sensitive information...