CVE-2022-25922 ICSA-22-063-01 Missing Authentication for Critical Function in Trailer Power Line Communications (PLC) J2497

Power Line Communications PLC4TRUCKS J2497 trailer brake controllers implement diagnostic functions which can be invoked by replaying J2497 messages. There is no authentication or authorization for these functions...

SUSE SLED15: gnutls / libgnutls-devel / libgnutls30 / libgnutls30-32bit / etc (SUSE-SU-2022:0717-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0717-1 advisory. - CVE-2021-4209: Fixed null pointer dereference in MDUPDATE bsc1196167. Tenable has extracted the preceding description...

The vulnerability of the Apache ShenYu software lies in the lack of authorization for critical functions, allowing attackers to circumvent established security restrictions.

The vulnerability of the Apache ShenYu software lies in the lack of authentication for a critical function. Exploiting this vulnerability allows a malicious actor to circumvent established security restrictions remotely...

Trailer Power Line Communications 安全漏洞

Trailer Power Line Communications is a bi-directional serial communications link on a vehicle power line from Transportation Systems Sector. A security vulnerability exists in Trailer Power Line Communications PLC J2497, which can be exploited by an attacker to perform diagnostic functions in the...

Trailer Power Line Communications (PLC) J2497

1. EXECUTIVE SUMMARY CVSS v3 9.3 ATTENTION: Exploitable remotely/low attack complexity Equipment: Power Line Communications PLC: J2497 a.k.a. PLC4TRUCKS Vulnerabilities: Missing Authentication for Critical Function, Improper Protection against Electromagnetic Fault Injection 2. RISK EVALUATION...

The vulnerability of the Apache ShenYu software lies in the lack of authorization for critical functions, which allows attackers to circumvent established security restrictions.

The vulnerability of the Apache ShenYu software lies in the lack of authorization for critical functions. Exploiting this vulnerability allows a malicious actor to bypass established security restrictions and gain access to the /plugin API without being authorized...

Exposure of home directory through shescape on Unix with Bash

Impact The issue allows for exposure of the home directory on Unix systems when using Bash with the escape or escapeAll functions from the shescape API with the interpolation option set to true. Other tested shells, Dash and Zsh, are not affected. javascript const cp = require"childprocess"; cons...

TeaBot Android Banking Malware Spreads Again Through Google Play Store Apps

An Android banking trojan designed to steal credentials and SMS messages has been observed once again sneaking past Google Play Store protections to target users of more than 400 banking and financial apps, including those from Russia, China, and the U.S. "TeaBot RAT capabilities are achieved via...

Ubuntu 20.04 LTS : PHP vulnerability (USN-5303-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5303-1 advisory. It was discovered that PHP incorrectly handled certain scripts. An attacker could possibly use this issue to cause a denial of service, or possibly execute...

Memory corruption

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTERVALIDATEFLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in...

CVE-2021-21708

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTERVALIDATEFLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in...

CVE-2021-21708

CVE-2021-21708 describes a use-after-free in PHP related to php_filter_float() failing for ints when using FILTER_VALIDATE_FLOAT with min/max limits, potentially causing crashes and memory corruption that could lead to RCE. Affected PHP versions include 7.4.x < 7.4.28, 8.0.x < 8.0.16, and 8...

Remote Code Execution (RCE)

limesurvey/limesurvey is vulnerable to remote code execution. An attacker can upload malicious files through the upload and install plugin functions in the library...

Nvidia GPU Display Driver for Linux拒绝服务漏洞

Nvidia GPU Display Driver for Linux is a driver for interactive support of graphics modules on Linux systems from Nvidia, Inc. A denial-of-service vulnerability exists in the Nvidia GPU Display Driver for Linux kernel driver package, which can be exploited by attackers to The vulnerability can be...

Exploit for Incorrect Permission Assignment for Critical Resource in Apache Cassandra

CVE-2021-44521 Automated PoC of CVE-2021-44521 Credits to orig...

Exploit for Incorrect Permission Assignment for Critical Resource in Apache Cassandra

CVE-2021-44521 Automated PoC of CVE-2021-44521 Credits to orig...

PT-2025-14275

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been identified where ENETC Virtual Functions VFs do not support HWTSTAMP TX ONESTEP SYNC. This is because only the ENETC Physical Function PF can...

Security Bulletin: Datastax Enterprise with IBM is vulnerable to exploiting Apache Cassandra User-Defined Functions for Remote Code Execution

Summary In Datastax Enterprise with IBM, a remote code execution RCE security vulnerability in Apache Cassandra exists and has been assigned to CVE-2021-44521. Vulnerability Details CVEID: CVE-2021-44521 DESCRIPTION: Apache Cassandra could allow a remote authenticated attacker to execute arbitrar...

Samsung Screwed Up Encryption on 100M Phones

Samsung shipped an estimated 100 million smartphones with botched encryption, including models ranging from the 2017 Galaxy S8 on up to last year’s Galaxy S21. Researchers at Tel Aviv University found what they called “severe” cryptographic design flaws that could have let attackers siphon the...

Add a timelock to setDefaultFeePercentage(),setCustomFeePercentageForCollateral(), setCustomFeePercentageForSafe() and setMinDebtPercentageForSaving()

Lines of code Vulnerability details Impact It is a good practice to give time for users to react and adjust to critical changes. A timelock provides more guarantees and reduces the level of trust required, thus decreasing risk for users. It also indicates that the project is legitimate. Here, no...