CVE-2022-45198

CVE-2022-45198 affects Pillow up to version 9.2.0, where improper handling of highly compressed GIF data (Data Amplification) can cause abnormal resource usage. Public sources confirm Pillow prior to 9.2.0 is vulnerable; advisories reference upgrades to mitigate. Debian LTS notes Pillow updates (...

Pillow 安全漏洞

Pillow is a Python based image processing library. A security vulnerability exists in Pillow versions prior to 9.2.0, which stems from improper handling of highly compressed GIF data...

Input validation

A vulnerability in Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling of certain TLS connections that are processed by an...

CVE-2022-38381

An improper handling of malformed request vulnerability CWE-228 exists in FortiADC 5.0 all versions, 6.0.0 all versions, 6.1.0 all versions, 6.2.0 through 6.2.3, and 7.0.0 through 7.0.2. This may allow a remote attacker without privileges to bypass some Web Application Firewall WAF protection suc...

Heap-based Buffer Overflow

libexiv2.so is vulnerable to heap-based buffer overflows. The vulnerability exists in the decodeBlock function of quicktimevideo.cpp due to improper handling of buffer size which allows an attacker to cause overflows resulting in an application crash...

Juniper Junos OS DoS (JSA69898)

The version of Junos OS installed on the remote host is affected by a DoS vulnerability as referenced in the JSA69898 advisory due to the Improper Handling of an Unexpected Data Type in the processing of EVPN routes on Juniper Networks Junos OS and Junos OS Evolved. An attacker in direct control ...

CVE-2022-22219

Summary: CVE-2022-22219 affects Junos OS and Junos OS Evolved. The issue arises from improper handling of an unexpected data type while processing EVPN routes, triggering an RPD crash on BGP route reflectors in EVPN multicast environments when one or more BGP clients have leave-sync-route-oldstyl...

CVE-2022-3540

An issue has been discovered in hunter2 affecting all versions before 2.1.0. Improper handling of auto-completion input allows an authenticated attacker to extract other users email addresses...

CVE-2022-3540

An issue has been discovered in hunter2 affecting all versions before 2.1.0. Improper handling of auto-completion input allows an authenticated attacker to extract other users email addresses...

WordPress Plugin WP Custom Cursors SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerability exists i...

CVE-2022-3290

Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8...

CVE-2022-3290

CVE-2022-3290 affects the rdiffweb project (ikis060/rdiffweb) prior to 2.4.8, where the root cause is improper handling/validation of the length parameter for the username field. This can be exploited to trigger a Denial of Service due to excessive memory use, with the DoS condition explicitly do...

GO-2022-1004 Improper handling of keys in github.com/theupdateframework/go-tuf

An attacker with the ability to insert public keys into a TUF repository can cause clients to accept a staged change that has not been signed by the correct threshold of signatures...

Denial Of Service (DoS)

tensorflow is vulnerable to denial of service. The vulnerability exists in Compute function of reshapeop.h because the number of elements size is not properly handled which allows an attacker to entry more than one element causing an application crash...

Microsoft Graphics Device Interface Buffer Overflow (CVE-2019-1439)

A heap-based buffer overflow vulnerability exists in the MF3216 component of Microsoft Windows. The vulnerability is due to improper handling of objects in memory. A remote attacker could exploit the vulnerability by enticing a user to open a specially crafted file and take actions...

Microsoft Graphics Device Interface Remote Code Execution (CVE-2018-8397)

A remote code execution vulnerability exists in the GDI components of Microsoft Windows. The vulnerability is due to improper handling of objects in memory. A remote attacker could exploit the vulnerability by enticing a user to open a specially crafted document...

Go-tuf Improperly handles multiple key IDs for the same public keys in attacker-controlled metadata

Issue If an attacker is able to control a threshold of keys to insert the same public key more than once with different key IDs into signed, trusted metadata on a TUF repository, then go-tuf clients 0.3.2 are susceptible to an attack where attackers can cause the same signature from the same publ...

GHSA-3633-5H82-39PQ Go-tuf Improperly handles multiple key IDs for the same public keys in attacker-controlled metadata

Issue If an attacker is able to control a threshold of keys to insert the same public key more than once with different key IDs into signed, trusted metadata on a TUF repository, then go-tuf clients 0.3.2 are susceptible to an attack where attackers can cause the same signature from the same publ...

Information Disclosure

github.com/containers/podman is vulnerable to Information Disclosure. The vulnerability exists in multiple functions due to improper handling of the supplementary groups in the Podman container engine which allows an attacker to gain access to containers and execute arbitrary codes...

Design/Logic Flaw

Improper Handling of Insufficient Permissions or Privileges vulnerability in Waterplugin prior to 2.2.11.22040751 allows attacker to access device IMEI and Serial number...