Security Bulletin: Potential Security Vulnerabilities fixed in IBM WebSphere Application Server 8.5.5.3

Summary Cross reference list for security vulnerabilites fixed in IBM WebSphere Application Server 8.5.5.3, IBM WebSphere Application Server Hypervisor 8.5.5.3 and IBM HTTP Server 8.5.5.3. Vulnerability Details CVE ID:CVE-2014-3022 APAR PI09594 DESCRIPTION: WebSphere Application Server allows for...

RosarioSIS before 10.1 vulnerable to Improper Handling of Length Parameter Inconsistency

RosarioSIS Student Information System prior to version 10.1 is vulnerable to Improper Handling of Length Parameter Inconsistency...

GHSA-VH4M-MW8W-G4W8 RosarioSIS before 10.1 vulnerable to Improper Handling of Length Parameter Inconsistency

RosarioSIS Student Information System prior to version 10.1 is vulnerable to Improper Handling of Length Parameter Inconsistency...

CVE-2022-2714

RosarioSIS (francoisjacquet/rosariosis) is affected by CVE-2022-2714 due to improper handling of length parameter inconsistencies. Public sources converge on affected versions being prior to 10.0 (Red Hat) and prior to 10.1 (GitHub advisory), indicating fixes are in 10.0/10.1 and later. A concret...

Null pointer dereference

A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution...

Regular Expression Denial Of Service (ReDoS)

dparse2 is vulnerable to regular expression denial of service attack. The vulnerability exists in parser.py due to improper handling of regular expressions which allows an attacker to send a specially crafted operator name causing a excessive resource consumption which then leads to an applicatio...

Path Traversal

streamlit is vulnerable to path traversal. The vulnerability exists in get function in ComponentRequestHandler due to improper handling of component requests outside the root directory which allows an attacker to access and overwrite the files by sending a malicious URL with file paths...

CVE-2022-22202

An Improper Handling of Exceptional Conditions vulnerability on specific PTX Series devices, including the PTX1000, PTX3000 NextGen, PTX5000, PTX10002-60C, PTX10008, and PTX10016 Series, in Juniper Networks Junos OS allows an unauthenticated MPLS-based attacker to cause a Denial of Service DoS by...

CVE-2022-22202

The CVE concerns Juniper Networks Junos OS on PTX Series (including PTX1000, PTX3000 NextGen, PTX5000, PTX10002-60C, PTX10008, PTX10016). It is an improper handling of exceptional conditions that allows an unauthenticated MPLS-based attacker to trigger a DoS by crashing the dcpfe process and rest...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

CVE-2022-22473

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper handling of Administrative Console data. This information could be used in further attacks against the system. IBM X-Force ID: 225347...

Design/Logic Flaw

A CWE-835: Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability exists that could cause a denial of service of the webserver due to improper handling of the cookies. Affected Products: X80 advanced RTU Communication Module BMENOR2200H V1.0, OPC UA Modicon Communication Module...

CVE-2022-34760

A CWE-835: Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability exists that could cause a denial of service of the webserver due to improper handling of the cookies. Affected Products: X80 advanced RTU Communication Module BMENOR2200H V1.0, OPC UA Modicon Communication Module...

CVE-2021-3433

Invalid channel map in CONNECTIND results to Deadlock. Zephyr versions = v2.5.0 Improper Check or Handling of Exceptional Conditions CWE-703. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3c2f-w4v6-qxrp...

Design/Logic Flaw

Invalid channel map in CONNECTIND results to Deadlock. Zephyr versions = v2.5.0 Improper Check or Handling of Exceptional Conditions CWE-703. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3c2f-w4v6-qxrp...

nodejs: Improper handling of URI Subject Alternative Names

A flaw was found in node.js where it accepted a certificate's Subject Alternative Names SAN entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host...

GHSA-RVGF-69J7-XH78 Uncontrolled Resource Consumption in @discordjs/opus

Improperly handled errors in @discordjs/opus cause hard crashes instead of returning the error to user land. All versions of package @discordjs/opus = 0.7.0 are vulnerable to Denial of Service DoS when trying to encode using an encoder with zero channels, or a non-initialized buffer. This leads t...

JVN#20930118: FreeBSD vulnerable to denial-of-service (DoS)

FreeBSD contains a denial-of-service DoS vulnerability CWE-400 due to improper handling of TSopt on TCP connections. Impact A remote attacker may be able to cause a denial-of-service DoS condition. Solution Update the software Update the software to the latest version according to the information...

Design/Logic Flaw

Improper handling between export and release functions on the same handle from client can lead to use after free in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile...

CVE-2021-35120

CVE-2021-35120 affects Qualcomm Snapdragon components (Compute, Connectivity, Industrial IOT, Mobile). Root cause: improper handling between export and release functions on the same client handle, causing a use-after-free. Impact is partial to high (per CVSS) with local attack, no user interactio...