PT-2022-33182

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.324 Description The issue is related to the xen/netback component, specifically with the function xenvif rx next skb, which can be entered with an empty rx queue. The actual impact and attack plausibility ha...

PT-2022-32974

Name of the Vulnerable Software and Affected Versions xen/netback versions prior to v5.4.207 Linux Kernel versions v4.9 through v5.4.206 Description The issue is related to the xen/netback component, specifically with the function xenvif rx next skb. It is possible to enter this function with an...

PT-2022-32849

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.132 Description The issue is related to the xen/netback component, specifically with the function xenvif rx next skb, which can be entered with an empty rx queue. The actual impact and attack plausibility...

go-ethereum:fuzzTxfetcher: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6701473429323776 Project: go-ethereum Fuzzing Engine: libFuzzer Fuzz Target: fuzzTxfetcher Job Type: libfuzzerasango-ethereum Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer: address...

crossplane:fuzz_parse: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6517735198162944 Project: crossplane Fuzzing Engine: libFuzzer Fuzz Target: fuzzparse Job Type: libfuzzerasancrossplane Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00c8248c6f0f Crash State: NULL Sanitizer: address ASAN Recommende...

github_scarecrow:scarecrow: Command injection with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5591770330693632 Project: githubscarecrow Fuzzing Engine: libFuzzer Fuzz Target: scarecrow Job Type: libfuzzerasangithubscarecrowtest Platform Id: linux Crash Type: Command injection Crash Address: Crash State: NULL Sanitizer: address ASAN Crash...

tinygltf:fuzz_gltf: Command injection with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5114449895227392 Project: tinygltf Fuzzing Engine: libFuzzer Fuzz Target: fuzzgltf Job Type: libfuzzerasantinygltf Platform Id: linux Crash Type: Command injection Crash Address: Crash State: NULL Sanitizer: address ASAN Crash Revision:...

CVE-2022-26117

An empty password in configuration file vulnerability CWE-258 in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may allow an authenticated attacker to access the MySQL databases via the CLI...

CVE-2022-26117

An empty password in configuration file vulnerability CWE-258 in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may allow an authenticated attacker to access the MySQL databases via the CLI...

Design/Logic Flaw

An empty password in configuration file vulnerability CWE-258 in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may allow an authenticated attacker to access the MySQL databases via the CLI...

grok:grk_decompress_fuzzer: Use-of-uninitialized-value with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6400484251926528 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzermsangrok Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: NULL Sanitizer: memory MSAN Recommended...

flac:fuzzer_metadata: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6124835096363008 Project: flac Fuzzing Engine: libFuzzer Fuzz Target: fuzzermetadata Job Type: libfuzzermsanflac Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000100005c18 Crash State: NULL Sanitizer: memory MSAN Recommended Securi...

USN-5506-1 nss vulnerabilities

Tavis Ormandy discovered that NSS incorrectly handled an empty pkcs7 sequence. A remote attacker could possibly use this issue to cause NSS to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.10. CVE-2022-22747 Ronald Crane...

PT-2022-3643 · Fortinet · Fortinac

Name of the Vulnerable Software and Affected Versions: FortiNAC versions 8.3.7 and below FortiNAC versions 8.5.2 and below FortiNAC versions 8.5.4 FortiNAC version 8.6.0 FortiNAC versions 8.6.5 and below FortiNAC versions 8.7.6 and below FortiNAC versions 8.8.11 and below FortiNAC versions 9.1.5...

hcl:fuzz_config: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5760287661228032 Project: hcl Fuzzing Engine: libFuzzer Fuzz Target: fuzzconfig Job Type: libfuzzerasanhcl Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x10c062c5e5d6 Crash State: NULL Sanitizer: address ASAN Recommended Security...

CLSA-2022-1655901847 Fix CVE(s): CVE-2022-2042

SECURITY UPDATE: Using uninitialized value and freed memory in spell command - debian/patches/CVE-2022-2042.patch: Initialize "attr" and check for empty line early - CVE-2022-2042...

MAL-2022-6050 Malicious code in sfdc-empty-chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6fc2d8b9c06b3b6ca1875897ebcf993a20d30c3d0c480503ac33251c1cc93aea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sfdc-empty-chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6fc2d8b9c06b3b6ca1875897ebcf993a20d30c3d0c480503ac33251c1cc93aea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-33174

Power Distribution Units running on Powertek firmware multiple brands before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface /cgi/getparam.cgi with the tmpToken cookie set to an emp...

CVE-2022-33174

Power Distribution Units running on Powertek firmware multiple brands before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface /cgi/getparam.cgi with the tmpToken cookie set to an emp...