UBUNTU-CVE-2021-41687

DCMTK through 3.6.6 does not handle memory free properly. The program malloc a heap memory for parsing data, but does not free it when error in parsing. Sending specific requests to the dcmqrdb program incur the memory leak. An attacker can use it to launch a DoS attack...

Out-of-bound read in function msg_outtrans_special

Description Out-of-bound read in function msgouttransspecial at message.c:1716 Version commit c101abff4c6756db4f5e740fde289decb9452efa HEAD - master, tag: v8.2.5164 Proof of Concept guest@elk:/trung$ valgrind ./vimlatest/src/vim -u NONE -i NONE -n -m -X -Z -e -s -S ./poc/poc4min2 -c :qa! ==23509=...

PT-2022-31264

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 4.12 through 5.17.13 Description The issue is related to a reset-controller leak on probe errors in the phy: qcom-qmp module. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

PT-2022-32127

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.247 Description The issue is related to a struct clk leak on probe errors in the qcom-qmp module. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel version...

PT-2022-31266

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.14 Description The issue is related to a struct clk leak on probe errors in the qcom-qmp module. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2022-3290

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 102 Mozilla Firefox ESR versions prior to 91.11 Thunderbird versions prior to 102 Thunderbird versions prior to 91.11 Description The issue is related to the implementation of protocols that deliver content to...

PT-2022-31054

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.3 Description The issue is related to the net: dsa: qca8k component, which does not correctly handle MDIO read errors. The actual impact and attack plausibility have not yet been proven. Recommendations For...

Upgraded Q -> M from 408 [1656345778095]

Judge has assessed an item in Issue 408 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> H from 413 [1656340258153]

Judge has assessed an item in Issue 413 as High risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...

Windows Ancillary Function Driver WinSock Privilege Escalation

The vulnerability of the Windows Ancillary Function Driver for WinSock in Windows operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to gain increased privileges...

MariaDB xbstream_open Buffer Overflow DoS

The vulnerability of the xbstreamopen function extra/mariabackup/dsxbstream.cc in the MariaDB database management system is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause service failures...

Upgraded Q -> M from 310 [1656347065145]

Judge has assessed an item in Issue 310 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...

CVE-2022-32206

curl 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually...

Upgraded Q -> H from 413 [1656341343180]

Judge has assessed an item in Issue 413 as High risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> M from 439 [1656339117398]

Judge has assessed an item in Issue 439 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...

Oracle Transportation Management UI Access

The vulnerability of the User Interface component of the Oracle Transportation Management software is related to errors in the code. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to data or modify data using HTTP requests...

AppContainer Kerberos Bypass

The vulnerability of the Kerberos authentication protocol implementation in a isolated software environment called AppContainer on Windows operating systems is related to security configuration errors. Exploiting this vulnerability can allow an attacker to circumvent security restrictions...

Hyper-V Hardware Virtualization Code Execution

The vulnerability of the Hyper-V hardware virtualization technology for Microsoft Windows operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Upgraded Q -> M from 184 [1656338695381]

Judge has assessed an item in Issue 184 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...

Unused Return

Lines of code Vulnerability details Impact Configuration Check: unused-return Severity: Medium Confidence: Medium Description: The return value of this external call is not stored in a local or state variable. Unused return values of function calls are indicative of programmer errors which may ha...