Intel Microcode Heap Buffer Overflow DoS

The vulnerability of Intel Microcode processors lies in memory initialization errors. Exploiting this vulnerability allows an attacker to gain access to confidential data...

Rounding errors can lead to wrong voting power

Lines of code Vulnerability details Impact The calculation of voting power in Crowdfund.getFinalContribution can lead to loss of voting power due to rounding errors. Tools Used Manual audit --- The text was updated successfully, but these errors were encountered: All reactions...

QEMU ioport hardware emulation Pointer Swapping DoS

The vulnerability of the ioport hardware emulation software under QEMU is related to pointer assignment errors. Exploiting this vulnerability allows an attacker to trigger a service failure...

Mozilla Firefox Android Resource Management Disclosure DoS

The vulnerability of the Mozilla Firefox browser for Android is related to resource management errors. Exploiting this vulnerability can allow a malicious actor to cause service failures and expose sensitive information...

IPython Shell Command Injection

The vulnerability of the shell command line interface for interactive IPython computations is related to access control errors. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

Mozilla Firefox Thunderbird Synchronization Disclosure

The vulnerabilities of Mozilla Firefox, Firefox ESR, and the email client Thunderbird are related to synchronization errors when using a common resource. Exploiting these vulnerabilities can allow an attacker, operating remotely, to disclose sensitive information...

MariaDB Pointer Assignment DoS

The vulnerability of the MariaDB database lies in pointer assignment errors. Exploiting this vulnerability allows an attacker to cause service failures...

MariaDB set_var.cc DoS

The vulnerability of the setvar.cc component of the MariaDB database system is related to errors during resource release. Exploiting this vulnerability allows an attacker to cause service failures...

Explained: Fuzzing for security

Fuzzing, or fuzz testing, is defined as an automated software testing method that uses a wide range of invalid and unexpected data as input to find flaws in the software undergoing the test. The flaws do not necessarily have to be security vulnerabilities. Fuzzing can also bring other undesirable...

CLSA-2022-1663184017 Fixed CVEs in curl: CVE-2022-32208, CVE-2022-32206

CVE-2022-32208: krb5: fix returning error on decode errors - CVE-2022-32206: contentencoding: return error on too many compression steps - fix a curl.spec's comment about applying TuxCare ELS patches - improve the test system by repeating failed tests several times...

LibGD gdImageClone Heap Buffer Overflow DoS

The vulnerability of the gdImageClone function in the gd.c component of the LibGD graphics library is related to pointer dereferencing errors. Exploiting this vulnerability allows an attacker to cause a service failure...

BusyBox wget Component Confidential Data Access

The vulnerability of the busybox wget component in the UNIX command-line utilities package is related to authentication process errors. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

ha_maria::extra MariaDB DoS

The vulnerability of the hamaria::extra component in the MariaDB database is related to errors during resource release. Exploiting this vulnerability allows an attacker to cause service failures...

MariaDB sql_parse.cc DoS

The vulnerability of the sqlparse.cc component in the MariaDB database system is related to errors during resource release. Exploiting this vulnerability allows an attacker to cause service failures...

Authorization

Pal Electronics Systems - Pal Gate Authorization Errors. The vulnerability is an authorization problem in PalGate device management android client app. Gates of bulidings and parking lots with a simple button in any smartphone. The API was found after a decompiling and static research using Jadx,...

CVE-2022-36782

CVE-2022-36782 involves an authorization flaw in PalGate’s Android device-management client. The vulnerability allows an attacker to enumerate IoT devices, view all entries/exits across gates worldwide, and extract a user database (over 2.8 million users) including names, phone numbers, and movem...

CVE-2022-36780 Avdor CIS - crystal quality Credentials Management Errors

Avdor CIS - crystal quality Credentials Management Errors. The product is phone call recorder, you can hear all the recorded calls without authenticate to the system. Attacker sends crafted URL to the system:...

libdnf bug fix and enhancement update

An update is available for libdnf. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list A library providing simplified C and Python API to the libsolv package...

PT-2022-5734 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is caused by synchronization errors when using a shared resource in the Advanced Local Procedure Call ALPC handler of the Windows operating system. This can allow an attacker to...

PT-2022-23194 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 11.5.16 Description: The issue arises when requesting invalid or non-existing resources via HTTP, triggering the page error handler to retrieve content from another page, leading to recursive application calls that...