CVE-2022-36039 Out-of-bounds write when parsing DEX files in Rizin

Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to out-of-bounds write when parsing DEX files. A user opening a malicious DEX file could be affected by this vulnerability, allowing an attacker to execute code on the user's...

SUSE-SU-2022:3101-1 Security update for zabbix

This update for zabbix fixes the following issues: - CVE-2022-35230: Javascript embedded in links for graphs page will be executed bsc1201290...

CVE-2022-2738

The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for CVE-2020-8945, which was previously fixed via RHSA-2020:2117. This issue could possibly be used to crash or cause potential code executio...

Mozilla: Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and Firefox ESR 91.13

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of members on the Mozilla Fuzzing Team reporting memory safety bugs present in Firefox 103, Firefox ESR 102.1, and Firefox ESR 91.12. Some of these bugs showed evidence of memory corruption, and we presume...

DEBIAN-CVE-2021-4041

A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansiblerunner.interface.runcommand, can lead to parameters getting executed as host's shell command. A developer could unintentionally write code that gets executed in the host rather than the virtual...

SonicWall SMA100 Post-Auth Heap-based Buffer Overflow Vulnerability

A Heap-based Buffer Overflow vulnerability in the SonicWall SMA100 appliance allows a remote authenticated attacker to cause Denial of Service DoS on the appliance or potentially lead to code execution. This vulnerability impacts 10.2.1.5-34sv and earlier versions.IMPORTANT: SMA 1000 series...

The vulnerability of the System Management Mode (SMM) implementation in HP notebook BIOS microprogramming systems allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the System Management Mode SMM implementation in HP notebook BIOS microprogramming systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to execute arbitrary code or cause system failures...

The vulnerability of the import function in GitHub’s software platform, based on Git, for collaborative code development on GitLab, allows a perpetrator to execute arbitrary code.

The vulnerability of the import function in GitHub’s software platform for Git-based collaborative code development on GitLab is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to execute arbitrary code within the target system...

PT-2022-4665 · Crow · Crow

Name of the Vulnerable Software and Affected Versions: Crow versions through 1.0+4 Description: The issue is related to HTTP applications based on Crow, where the use of HTTP pipelining can lead to a Use-After-Free condition, potentially allowing code execution. This occurs because the asynchrono...

XPDF 输入验证错误漏洞

XPDF is an open source PDF reader from FOO Labs. The product supports decoding files in LZW compressed format and reading encrypted PDF files. A security vulnerability exists in XPDF versions prior to 4.04, which stems from the JBIG2Stream::readSymbolDictSeg function in the JBIG2Stream.cc compone...

PT-2022-4406 · Mcafee · Mcafee Security Scan Plus

Name of the Vulnerable Software and Affected Versions: McAfee Security Scan Plus versions prior to 4.1.262.1 Description: The issue is related to improper privilege management, which could allow a local user to modify a configuration file. This modification can lead to a Living off the Land LOLBi...

PT-2022-5984 · Centreon · Centreon

Name of the Vulnerable Software and Affected Versions: Centreon affected versions not specified Description: The issue is related to the lack of protection for the SQL query structure in Centreon, a software for monitoring IT infrastructure. This could allow a remote attacker to execute arbitrary...

PT-2022-4392 · Adobe · Framemaker

Name of the Vulnerable Software and Affected Versions: Adobe FrameMaker versions 2019 Update 8 and earlier Adobe FrameMaker versions 2020 Update 4 and earlier Description: The issue is related to an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past th...

USN-5221-1 redis vulnerabilities

It was discovered that Redis incorrectly handled certain specially crafted Lua scripts. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2021-32626 It was discovered that Redis incorrectly handled some malformed requests when using Redis...

GO-2022-0475 Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo

The go command may execute arbitrary code at build time when cgo is in use. This may occur when running go get on a malicious package, or any other command that builds untrusted code. This can be caused by malicious unquoted symbol name in a linked object file...

CVE-2022-31206

The Omron SYSMAC Nx product family PLCs NJ series, NY series, NX series, and PMAC series through 2022-005-18 lack cryptographic authentication. These PLCs are programmed using the SYMAC Studio engineering software which compiles IEC 61131-3 conformant POU code to native machine code for execution...

UBUNTU-CVE-2021-46829

GNOME GdkPixbuf aka GDK-PixBuf before 2.42.8 allows a heap-based buffer overflow when compositing or clearing frames in GIF files, as demonstrated by io-gif-animation.c compositeframe. This overflow is controllable and could be abused for code execution, especially on 32-bit systems...

PT-2022-4408

Name of the Vulnerable Software and Affected Versions Apache Calcite Avatica JDBC driver versions prior to 1.22.0 Description The issue is related to the creation of HTTP client instances based on class names provided via the httpclient impl connection property. The driver does not verify if the...

PT-2022-11483 · Unknown · Fabric 8 Kubernetes Client

Name of the Vulnerable Software and Affected Versions: Fabric 8 Kubernetes client versions 5.0.0-beta-1 and above Description: A flaw was found in the Fabric 8 Kubernetes client due to improperly configured YAML parsing, allowing a local and privileged attacker to supply malicious YAML, which can...

Siemens Teamcenter Visualization 缓冲区错误漏洞

JT2Go is a 3D JT viewing tool that allows users to view JT, PDF, Solid Edge, PLM XML, and available JT, VFZ, CGM, and TIF data. teamcenter Visualization enables companies to enhance their product lifecycle management PLM environments with a comprehensive family of visualization solutions. The...