6398 matches found
flac:fuzzer_metadata: Crash with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=6124835096363008 Project: flac Fuzzing Engine: libFuzzer Fuzz Target: fuzzermetadata Job Type: libfuzzermsanflac Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000100005c18 Crash State: NULL Sanitizer: memory MSAN Recommended Securi...
USN-5506-1 nss vulnerabilities
Tavis Ormandy discovered that NSS incorrectly handled an empty pkcs7 sequence. A remote attacker could possibly use this issue to cause NSS to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.10. CVE-2022-22747 Ronald Crane...
PT-2022-3643 · Fortinet · Fortinac
Name of the Vulnerable Software and Affected Versions: FortiNAC versions 8.3.7 and below FortiNAC versions 8.5.2 and below FortiNAC versions 8.5.4 FortiNAC version 8.6.0 FortiNAC versions 8.6.5 and below FortiNAC versions 8.7.6 and below FortiNAC versions 8.8.11 and below FortiNAC versions 9.1.5...
hcl:fuzz_config: Crash with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=5760287661228032 Project: hcl Fuzzing Engine: libFuzzer Fuzz Target: fuzzconfig Job Type: libfuzzerasanhcl Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x10c062c5e5d6 Crash State: NULL Sanitizer: address ASAN Recommended Security...
CLSA-2022-1655901847 Fix CVE(s): CVE-2022-2042
SECURITY UPDATE: Using uninitialized value and freed memory in spell command - debian/patches/CVE-2022-2042.patch: Initialize "attr" and check for empty line early - CVE-2022-2042...
Malicious code in sfdc-empty-chart (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6fc2d8b9c06b3b6ca1875897ebcf993a20d30c3d0c480503ac33251c1cc93aea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-6050 Malicious code in sfdc-empty-chart (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6fc2d8b9c06b3b6ca1875897ebcf993a20d30c3d0c480503ac33251c1cc93aea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-33174
Power Distribution Units running on Powertek firmware multiple brands before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface /cgi/getparam.cgi with the tmpToken cookie set to an emp...
CVE-2022-33174
Power Distribution Units running on Powertek firmware multiple brands before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface /cgi/getparam.cgi with the tmpToken cookie set to an emp...
Denial Of Service (DoS)
libjpeg.so is vulnerable to denial of service. An attacker can crash the application by providing an empty JPEG-LS scan because the SampleInterleavedLSScan function of sampleinterleavedlsscan.cpp and SingleComponentLSScan function of singlecomponentlsscan.cpp does not properly handle empty JPEG-L...
DEBIAN-CVE-2022-32978
There is an assertion failure in SingleComponentLSScan::ParseMCU in singlecomponentlsscan.cpp in libjpeg before 1.64 via an empty JPEG-LS scan...
CVE-2022-32978
There is an assertion failure in SingleComponentLSScan::ParseMCU in singlecomponentlsscan.cpp in libjpeg before 1.64 via an empty JPEG-LS scan...
USN-5461-1 freerdp2 vulnerabilities
It was discovered that FreeRDP incorrectly handled empty password values. A remote attacker could use this issue to bypass server authentication. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.10. CVE-2022-24882 It was discovered that FreeRDP incorrectly handled server...
_verifyProof allows empty proofs (allows malleable transactions)
Lines of code Vulnerability details Impact verifyProof allows empty proofs and in that case it expects the leaf to equal the root, because no hashing and iteration is taking place. The purpose of the tree is to hold multiple accepted tokenIds, where the consideration contains one and proving its...
Improper Authentication (empty password) in Jenkins Active Directory Plugin
Jenkins Active Directory Plugin implements two separate modes: Integration with ADSI on Windows, and an OS agnostic LDAP-based mode. The Windows/ADSI mode does not specifically prohibit use of empty passwords in Active Directory Plugin prior to 2.20 and 2.16.1. If the Active Directory server allo...
buildah: Default inheritable capabilities for linux container should be empty
A flaw was found in buildah, where containers were incorrectly started with non-empty default permissions. A bug was found in Moby Docker Engine where containers were incorrectly started with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs wi...
GHSA-6WGP-FWFM-MXP3 Django allows user sessions hijacking via an empty string in the session key
The session.flush function in the cacheddb backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key...
GHSA-Q3CJ-2R34-2CWC Improper input validation in cryptography
HKDF in cryptography before 1.5.3 returns an empty byte-string if used with a length less than algorithm.digestsize...
GHSA-PGXH-WFW4-JX2V Django denial of service via empty session record creation
contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service session store consumption or session record removal via a large number of requests to...