PT-2022-6310 · Ibm · Ibm Cloud Pak For Multicloud Management Monitoring

Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak for Multicloud Management Monitoring versions 2.0 through 2.3 Description: The issue is related to incorrect restriction of a directory path with limited access. Exploitation of this issue may allow a remote attacker to elevate...

FreeBSD : zydis -- heap buffer overflow (d487d4fc-43a8-11ed-8b01-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the d487d4fc-43a8-11ed-8b01-b42e991fc52e advisory. - Zydis is an x86/x86-64 disassembler library. Users of Zydis versions v3.2.0 and older that use the...

PT-2022-36662 · Git +1 · Mapserver

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow WRITE 1 crash has been reported. The crash involves the functions msyylex, loadMapInternal, and msLoadMap. No information is...

Malicious Package

Overview pages-functions-with-routes-app is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable i...

PT-2022-36657 · Git +1 · Hunspell

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read, which occurs in the AffixMgr::cpdcase check and AffixMgr::compound check functions, ultimately calle...

PT-2022-36654 · Git +1 · Skia

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read error. Technical details about the crash include the SkRect::setBoundsCheck, SkEdgeClipper::clipCubic...

PT-2022-37328 · Exiv2 · Exiv2

Name of the Vulnerable Software and Affected Versions: Exiv2 affected versions not specified Description: A heap-buffer-overflow read issue has been identified. The crash occurs in the Exiv2::QuickTimeVideo::userDataDecoder and Exiv2::QuickTimeVideo::tagDecoder functions. Recommendations: At the...

PT-2022-36655 · Git +1 · Upb

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash, specifically a Segv on an unknown address. The crash involves the functions upb MiniTable SetSubEnum, upb MessageDef...

PT-2022-37321 · Git +1 · Skia

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read crash. Technical details about the crash include the SkEdgeClipper::ClipPath,...

PT-2022-37318 · Git +1 · Skia

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read error. Technical details about the crash include the SkPath::Iter::next function,...

Stronger Cloud Security in Azure Functions Using Custom Cloud Container

In this entry, we discuss how developers can use custom cloud container image and the distroless approach to minimize security gaps in Azure Functions...

PT-2022-37317 · Git +1 · Skia

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read error. Technical details about the crash include the SkPath::Iter::next function,...

PT-2022-37322 · Git +1 · Fluent-Bit

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read, which was identified through an OSS-Fuzz report. The crash state includes functions such as onig...

APR Library Buffer Overflow DoS

The vulnerability of the aprtimeexp and aprosexptime functions in the APR library lies in the reading of data beyond the allowable buffer size. Exploiting this vulnerability allows an attacker to access confidential data and also cause service failures...

PT-2022-37315 · Git +1 · Skia

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read crash. Technical details include the crash type being a Heap-buffer-overflow READ 4, and the crash...

CVE-2022-23006 Buffer Overflow Vulnerability in Western Digital My Cloud Home Products and SanDisk ibi

A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow an attacker accessing the system locally to read information from /etc/version file. This vulnerability can only be exploited by chaining it with another...

PT-2022-37311 · Git +1 · Lcms

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash caused by the use of an uninitialized value. The crash occurs in the following functions: cmsMLUgetASCII, Type Text...

VRF v1 is depreciated but v2 has different interface

Lines of code Vulnerability details Impact Since VRF v2 is replacing v1, v1 interface might be unavailable some day in the future. Since the v2 interface is different, at that time, the functions depend on VRF v1 will not work. The protocol will not operate due to denial of service. Proof of...

PT-2022-37297 · Libraw · Libraw

Name of the Vulnerable Software and Affected Versions: LibRaw affected versions not specified Description: The issue is related to an index-out-of-bounds crash. Technical details about the crash include the parse tiff ifd function, the parse tiff function, and the identify function...

CVE-2022-36944

Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network...