7042 matches found
Nextcloud: [user_oidc] Stored XSS via Authorization Endpoint - Safari-Only
Summary: The OpenID Connect User Backend allows users to login to Nextcloud using SSO. A workaround that was apparently implemented for the Safari browser enables stored Cross-Site-Scripting XSS. The vulnerability only affects user agents that include "Safari" within their user agent string and i...
FreeBSD : chromium -- multiple vulnerabilities (f2043ff6-2916-11ed-a1ef-3065ec8fd3ec)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the f2043ff6-2916-11ed-a1ef-3065ec8fd3ec advisory. - Use after free in Network Service. CVE-2022-3038 - Use after free in WebSQL. CVE-2022-3039,...
CVE-2022-1259
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629...
CVE-2022-1259
CVE-2022-1259 is an Undertow-related denial-of-service issue. The root cause is an incomplete fix for CVE-2021-3629, causing potential DoS from HTTP/2 flow-control handling. Connected documents (Nessus plugin references and IBM/Red Hat advisories) confirm this in context of Undertow and note that...
CVE-2022-1259
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629...
PT-2022-13755 · Undertow · Undertow
Name of the Vulnerable Software and Affected Versions: Undertow affected versions not specified Description: A flaw was found in Undertow, related to flow control handling by the browser over HTTP/2, which may cause overhead or a denial of service in the server. This issue is due to an incomplete...
Fuji Electric D300win 缓冲区错误漏洞
The Fuji Electric D300win is a PLC product and solution from Fuji Electric Japan. A security vulnerability exists in the Fuji Electric D300win that stems from vulnerability to a write-what-where condition, which can be exploited by an attacker to overwrite program memory in order to manipulate th...
KLA15732 Multiple vulnerabilities in Google Chrome
Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, bypass security restrictions. Below is a complete list of vulnerabilities: 1. Use after free vulnerability in Layout can be exploited to caus...
Ubuntu: Security Advisory (USN-395-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Cybersecurity Analysts: Job Stress Is Bad, but Boredom Is Kryptonite
Years ago, “airline pilot” used to be a high-stress profession. Imagine being in personal control of equipment worth millions hurtling through the sky on an irregular schedule with the lives of all the passengers in your hands. But today on any given flight, autopilot is engaged almost 90% of the...
Cisco Adaptive Security Appliance (ASA) Software FTP Inspection Bypass Vulnerability (cisco-sa-asaftd-ftpbypass-HY3UTxYu)
According to its self-reported version number, there is a vulnerability in the FTP inspection engine of Cisco Adaptive Security Appliance ASA Software that could allow an unauthenticated, remote attacker to bypass FTP inspection. The vulnerability is due to ineffective flow tracking of FTP traffi...
The vulnerability of the Uninstall Protection function of the Crowdstrike Falcon endpoint protection software allows a malicious actor to remove the CrowdStrike software.
The vulnerability of the Uninstall Protection function of the Crowdstrike Falcon endpoint protection software is related to the implementation of an incorrect management flow. Exploiting this vulnerability could allow a malicious individual to remove the CrowdStrike software without using a valid...
Cisco Firepower Threat Defense (FTD) Software FTP Inspection Bypass Vulnerability (cisco-sa-asaftd-ftpbypass-HY3UTxYu)
According to its self-reported version number, there is a vulnerability in the FTP inspection engine of Cisco Firepower Threat Defense FTD Software that could allow an unauthenticated, remote attacker to bypass FTP inspection. The vulnerability is due to ineffective flow tracking of FTP traffic. ...
Chromium: CVE-2022-2858 Use after free in Sign-In Flow
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Polar Flow Android 5.7.1 Secret Disclosure Vulnerability
Insecure data storage in Polar Flow Android application Overview Advisory ID: TRSA-2110-01 Advisory version: 1.0 Advisory status: Public Advisory URL: https://trovent.io/security-advisory-2110-01 Affected product: Polar Flow Android mobile application fi.polar.polarflow Affected version: 5.7.1...
CVE-2022-21793
Insufficient control flow management in the IntelR Ethernet 500 Series Controller drivers for VMWare before version 1.11.4.0 and in the IntelR Ethernet 700 Series Controller drivers for VMWare before version 2.1.5.0 may allow an authenticated user to potentially enable a denial of service via loc...
Design/Logic Flaw
Insufficient control flow management in the IntelR Ethernet 500 Series Controller drivers for VMWare before version 1.11.4.0 and in the IntelR Ethernet 700 Series Controller drivers for VMWare before version 2.1.5.0 may allow an authenticated user to potentially enable a denial of service via loc...
CVE-2022-21793
CVE-2022-21793 is a vulnerability in Intel® Ethernet VMware drivers. The issue is caused by insufficient control flow management in the Intel® Ethernet 500 Series Controller drivers for VMware before version 1.11.4.0 and in the Intel® Ethernet 700 Series Controller drivers for VMware before versi...
CVE-2022-21793
Insufficient control flow management in the IntelR Ethernet 500 Series Controller drivers for VMWare before version 1.11.4.0 and in the IntelR Ethernet 700 Series Controller drivers for VMWare before version 2.1.5.0 may allow an authenticated user to potentially enable a denial of service via loc...
