8881 matches found
Huawei EulerOS: Security Advisory for sssd (EulerOS-SA-2022-1097)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
TikTok: Instance Page DOS within Organization on TikTok Ads
A vulnerability was found on the Instance Page service of TikTok Ads, which would allow an Operator to perform a Denial of Service DoS on the Front End of only their own organization. We thank @arsenelupin for reporting this to our team...
OESA-2022-1513 log4j12 security update
With log4j it is possible to enable logging at runtime without modifying the application binary. Security Fixes: JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and...
Keybase Information Disclosure Vulnerability (CNVD-2022-11494)
Keybase is a PGP-based social networking platform that supports end-to-end encryption. keybase is vulnerable to an information disclosure vulnerability that could be exploited by an attacker to disclose sensitive information that should be removed from a user's file system...
Serialization vulnerability in Apache Tapestry
A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life in 2008 and no update to...
GHSA-C566-2GRG-MJWG Serialization vulnerability in Apache Tapestry
A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life in 2008 and no update to...
UBUNTU-CVE-2022-0521
Access of Memory Location After End of Buffer in GitHub repository radareorg/radare2 prior to 5.6.2...
Schneider Electric Web Server on Modicon M340 Out-of-Bounds Read (CVE-2020-7562)
A CWE-125: Out-of-Bounds Read vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules see notification for details which could cause a segmentation fault or a buffer overflow when uploading a specially crafted file ...
Schneider Electric Modicon Controllers Use of Insufficiently Random Values (CVE-2019-6821)
CWE-330: Use of Insufficiently Random Values vulnerability, which could cause the hijacking of the TCP connection when using Ethernet communication in Modicon M580 firmware versions prior to V2.30, and all firmware versions of Modicon M340, Modicon Premium, Modicon Quantum. This plugin only works...
CVE-2021-46671
options.c in atftp before 0.7.5 reads past the end of an array, and consequently discloses server-side /etc/group data to a remote client...
CVE-2022-24168
Tenda routers G1 and G3 v15.11.0.179502CN were discovered to contain a command injection vulnerability in the function formSetIpGroup. This vulnerability allows attackers to execute arbitrary commands via the IPGroupStartIP and IPGroupEndIP parameters...
CVE-2022-24171
Tenda routers G1 and G3 v15.11.0.179502CN were discovered to contain a command injection vulnerability in the function formSetPppoeServer. This vulnerability allows attackers to execute arbitrary commands via the pppoeServerIP, pppoeServerStartIP, and pppoeServerEndIP parameters...
CVE-2022-24155
Tenda AX3 v16.03.12.10CN was discovered to contain a heap overflow in the function setSchedWifi. This vulnerability allows attackers to cause a Denial of Service DoS via the schedStartTime and schedEndTime parameters...
Tenda AX3 缓冲区错误漏洞
Tenda Ax3 is an Ax1800 Gigabit port dual-band Wifi 6 wireless router from Tenda China. Tenda AX3 v16.03.12.10CN is vulnerable to a buffer overflow vulnerability, which can be exploited by attackers to cause a denial of service DoS via the schedStartTime and schedEndTime parameters...
What You Need to Do Today to Protect Against Account Takeover Attacks
Historically, account takeover ATO has been recognized as an attack in which cybercriminals take ownership of online accounts using stolen passwords and usernames. Cybercriminals purchase a list of account credentials from the dark web that are usually compiled by hackers through social...
HPESBNW04239 rev.3 - HPE Aruba 9000 Series Gateways, Multiple UEFI Vulnerabilities
Potential Security Impact: Local: Access Restriction Bypass, Arbitrary Code Execution, Compromise of System Integrity, Elevated Privileges, Gain Extended Privileges, Increase in Privilege, memory corruption SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba 9000 Gateway - See...
CLSA-2022-1643640747 Fixed CVEs in vim: CVE-2022-0213, CVE-2022-0261
CVE-2022-0213: fix going over the end of status line buffer - CVE-2022-0261: fix block insert goes over the end of the line...
CLSA-2022-1643640508 Fix of CVE: CVE-2022-0261, CVE-2022-0213
CVE-2022-0213: fix going over the end of status line buffer - CVE-2022-0261: fix block insert goes over the end of the line...
CLSA-2022-1643639170 Fix CVE(s): CVE-2022-0213, CVE-2022-0261
SECURITY UPDATE: Going over the end of status line buffer - debian/patches/CVE-2022-0213.patch: Check line length when appending a space to NameBuff - CVE-2022-0213 SECURITY UPDATE: Block insert goes over the end of the line - debian/patches/CVE-2022-0261.patch: Handle invalid byte better and fix...
