6379 matches found
Intel Glorp 代码问题漏洞
Intel Glorp is a U.S. Intel Intel application. Intel Glorp version 1.0.0 contains an elevation of privilege vulnerability, which originates from an uncontrolled search path element in the IntelR Glorp software and can be exploited by attackers for local elevation of privilege...
CVE-2022-41904 Element iOS is vulnerable due to missing decoration for events decrypted with untrusted Megolm sessions
Element iOS is an iOS Matrix client provided by Element. It is based on MatrixSDK. Prior to version 1.9.7, events encrypted using Megolm for which trust could not be established did not get decorated accordingly with warning shields. Therefore a malicious homeserver could inject messages into the...
CVE-2022-41904 Element iOS is vulnerable due to missing decoration for events decrypted with untrusted Megolm sessions
Element iOS is an iOS Matrix client provided by Element. It is based on MatrixSDK. Prior to version 1.9.7, events encrypted using Megolm for which trust could not be established did not get decorated accordingly with warning shields. Therefore a malicious homeserver could inject messages into the...
CVE-2022-41904
Element iOS (MatrixSDK-based) was vulnerable before version 1.9.7: Megolm-encrypted events from untrusted sessions could be injected without warning, even if all group members were verified. The issue is fixed in Element iOS 1.9.7; no public workarounds are known. Upgrade to 1.9.7+ to remediate.
PT-2022-22678 · Intel · Intel Nuc 8 Compute Element
Name of the Vulnerable Software and Affected Versions: IntelR NUC 8 Compute Elements versions prior to CBWHL357.0096 Description: The issue is related to improper access control in BIOS firmware, which may allow a privileged user to potentially enable escalation of privilege via local access...
Is Cybersecurity Awareness Month Anything More Than PR?
Cybersecurity Awareness Month has been going on since 2004. This year, Cybersecurity Awareness Month urged the public, professionals, and industry partners to "see themselves in cyber" in the following ways: 1. The public, by taking action to stay safe online. 2. Professionals, by joining the cyb...
expat: integer overflow in the doProlog function
A flaw was found in expat. The vulnerability occurs due to large content in element type declarations when there is an element declaration handler present which leads to an integer overflow. This flaw allows an attacker to inject an unsigned integer, leading to a crash or a denial of service...
kernel: ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Avoid out of bounds access when parsing CPC data If the NumEntries field in the CPC return package is less than 2, do not attempt to access the "Revision" element of that package, because it may not be present then...
NEC Expresscluster X 代码问题漏洞
NEC Expresscluster X is a specialized high availability cluster software from Nippon Electric NEC. It is used to enable fast restore functions and continuously protect critical applications and data. A security vulnerability exists in NEC Expresscluster X 5.0 for Windows and prior versions,...
owasp-java-html-sanitizer: improper policies enforcement may lead to remote code execution
The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements...
D-Link DIR-1935 SetSysLogSettings IPAddress Command Injection Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handli...
PT-2022-5760 · Fortinet · Fortitester
Name of the Vulnerable Software and Affected Versions: FortiTester versions 3.0.0 through 3.9.1 FortiTester versions 4.0.0 through 4.2.0 FortiTester versions 7.0.0 through 7.1.0 Description: The issue is related to an improper neutralization of special elements used in an OS command, which may...
expat: integer overflow in the doProlog function
A flaw was found in expat. The vulnerability occurs due to large content in element type declarations when there is an element declaration handler present which leads to an integer overflow. This flaw allows an attacker to inject an unsigned integer, leading to a crash or a denial of service...
Ubuntu 22.10 : Linux kernel vulnerabilities (USN-5700-1)
The remote Ubuntu 22.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5700-1 advisory. David Bouman and Billy Jheng Bing Jhong discovered that a race condition existed in the iouring subsystem in the Linux kernel, leading to a use- after-free...
GHSA-RJ5F-VM79-5J84 OctoPrint vulnerable to Special Element Injection
OctoPrint prior to 1.8.3 is vulnerable to Special Element Injection...
OctoPrint vulnerable to Special Element Injection
OctoPrint prior to 1.8.3 is vulnerable to Special Element Injection...
CVE-2022-3607
Failure to Sanitize Special Elements into a Different Plane Special Element Injection in GitHub repository octoprint/octoprint prior to 1.8.3...
PYSEC-2022-42975
Failure to Sanitize Special Elements into a Different Plane Special Element Injection in GitHub repository octoprint/octoprint prior to 1.8.3...
