Design/Logic Flaw

A vulnerability has been identified in SICAM PQ Analyzer All versions V3.18. A service is started by an unquoted registry entry. As there are spaces in this path, attackers with write privilege to those directories might be able to plant executables that will run in place of the legitimate proces...

CVE-2021-45460

A vulnerability has been identified in SICAM PQ Analyzer All versions V3.18. A service is started by an unquoted registry entry. As there are spaces in this path, attackers with write privilege to those directories might be able to plant executables that will run in place of the legitimate proces...

ALPINE-CVE-2022-22844

LibTIFF 4.3.0 has an out-of-bounds read in TIFFmemcpy in tifunix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field...

UBUNTU-CVE-2022-22844

LibTIFF 4.3.0 has an out-of-bounds read in TIFFmemcpy in tifunix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field...

CVE-2021-22060

In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more...

Silicon Graphics LibTIFF 缓冲区错误漏洞

Silicon Graphics LibTIFF is a library for reading and writing TIFF Tagged Image File Format files from Silicon Graphics, USA. The library contains some command line tools for working with TIFF files. A security vulnerability exists in Silicon Graphics LibTIFF 4.3.0, which stems from a read...

Security Bulletin: Vulnerability in Node.js affects IBM Event Streams

Summary There is a vulnerability in the Node.js ua-parser-js open source module. The library is used by the IBM Event Streams. Vulnerability Details Third Party Entry: 211964 DESCRIPTION: Node.js ua-parser-js module could allow a remote attacker to execute arbitrary code on the system, caused by...

PT-2025-8495

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved. The issue is related to the KVM x86 component, where the update of guest PTE A/D bits was not properly handled. The VM PFNMAP path...

CVE-2021-45684

An issue was discovered in the flumedb crate through 2021-01-07 for Rust. readentry may read from uninitialized memory locations...

Rust flumedb crate 安全漏洞

Rust flumedb crate is a new architecture in which the Sunrise choir sink is a rewrite of JavaScript flumedb into rust to gain better performance and flexibility. a security vulnerability exists in Rust flumedb crate that stems from the fact that readentry can read data from an uninitialized memor...

CVE-2021-45469

In f2fssetxattr in fs/f2fs/xattr.c in the Linux kernel through 5.15.11, there is an out-of-bounds memory access when an inode has an invalid last xattr entry...

CVE-2021-45469

In f2fssetxattr in fs/f2fs/xattr.c in the Linux kernel through 5.15.11, there is an out-of-bounds memory access when an inode has an invalid last xattr entry...

Linux kernel 缓冲区错误漏洞

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel versions prior to 5.15.11 have a security vulnerability that stems from f2fssetxattr in fs/f2fs/xattr.c in the Linux kernel, which can be exploited when an inode has an invalid last xattr...

Pool Manager can frontrun fees to 100% and use it to steal the value from users

Handle pedroais Vulnerability details Impact Pool Manager can front-run entry fee to 100% and users could lose all their deposits Proof of Concept Considering : The pool manager is the creator of the pool Anyone can create a pool Manager is not a trusted actor Anyone can create a pool and get...

More on NSO Group and Cytrox: Two Cyberweapons Arms Manufacturers

Citizen Lab published another report on the spyware used against two Egyptian nationals. One was hacked by NSO Groups Pegasus spyware. The other was hacked both by Pegasus and by the spyware from another cyberweapons arms manufacturer: Cytrox. We havent heard a lot about Cytrox and its Predator...

Basket's max cap can be surpassed due to beneficiary entry fee

Handle kenzo Vulnerability details When joining a basket, the function verifies that the total supply + tokens the user asks to mint is smaller than the basket's max supply. However, this doesn't take into account the fact that additional tokens will be minted if there's an entry fee beneficiary...

XStream: Unsafe deserizaliation of com.sun.corba.se.impl.activation.ServerTableEntry

A flaw was found in xstream. A remote attacker, who has sufficient rights, can execute commands of the host by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

CVE-2021-44948

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-44942. Reason: This candidate is a duplicate of CVE-2021-44942. Notes: All CVE users should reference CVE-2021-44942 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage...

CVE-2021-43813

creationtimestamp| type| source ---|---|--- 2021-12-10 20:25:18+00:00| seen| https://t.me/cibsecurity/33752...

Someone Is Running Lots of Tor Relays

Since 2017, someone is running about a thousand -- 10% of the total -- Tor servers in an attempt to deanonymize the network: Grouping these servers under the KAX17 umbrella, Nusenu says this threat actor has constantly added servers with no contact details to the Tor network in industrial...