CVE-2022-0317 Improper Input Validation in AKPublic.Verify in go-attestation

An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the...

CVE-2022-0317 Improper Input Validation in AKPublic.Verify in go-attestation

An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the...

CVE-2022-0317 Improper Input Validation in AKPublic.Verify in go-attestation

An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the...

CVE-2022-22727

A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated attacker to view data, change settings, impact availability of the software, or potentially impact a user�s local machine when the user clicks a specially crafted link. Affected Product: EcoStruxure Power...

CVE-2022-22727

CVE-2022-22727 is an instance of an improper input validation (CWE-20) vulnerability in Schneider Electric’s EcoStruxure Power Monitoring Expert (versions 2020 and prior). The CVE describes that an unauthenticated attacker could view data, change settings, or impact availability, potentially affe...

CVE-2021-22288 SECURITY – Denial of Service Vulnerabilities in SPIET800 INFI-Net to Ethernet Transfer module and PNI800 S+ Ethernet communication interface module

Improper Input Validation vulnerability in the ABB SPIET800 and PNI800 module allows an attacker to cause the denial of service or make the module unresponsive...

CVE-2021-22288

The CVE-2021-22288 issue affects ABB Symphony Plus SPIET800 and PNI800 network interfaces. Public docs describe an Uncontrolled Resource Consumption vulnerability (CWE-400) that can cause the device to become unresponsive and require a reboot, with a CVSSv3.1 base score of 7.5 (Network, Low attac...

Improper Input Validation

org.apache.pulsar, pulsar is vulnerable to improper input validation. The vulnerability exists due to improper access restrictions in internalResetCursorOnPosition function in PersistentTopicsBase.javafile which allows an attacker to bypass security and read the ledger...

Sensormatic PowerManage (Update A)

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Sensormatic Electronics, LLC, a subsidiary of Johnson Controls Inc Equipment: PowerManage Vulnerability: Improper Input Validation 2. UPDATE INFORMATION This update advisory is a follow-up to the...

GHSA-99CG-575X-774P Go-Attestation Improper Input Validation with attacker-controlled TPM Quote

Impact An improper input validation vulnerability in go-attestation before 0.4.0 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the...

Go-Attestation Improper Input Validation with attacker-controlled TPM Quote

Impact An improper input validation vulnerability in go-attestation before 0.4.0 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the...

Sealevel Systems, Inc. SeaConnect 370W OTA update task file overwrite vulnerability

Summary A file write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to arbitrary file overwrite. An attacker can perform a man-in-the-middle attack to trigger this vulnerability. Tested Version...

Apple Safari Security Update (HT213058)

Apple Safari is prone to multiple vulnerabilities according to Apple security advisory. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Denial Of Service (DoS)

openjdk1 is vulnerable to denial of service. The vulnerability exists due to improper input validation in the ImageIO component allows attacker to perform service disruption...

Improper Input Validation

openjdk11, edge is vulnerable to improper input validation. The vulnerability exists due to improper input validation within the JAXP component allow attacker to exploit this vulnerability to gain access to sensitive information...

CVE-2021-22826

A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits a page containing the injected payload. This CVE is unique from CVE-2021-22827. Affected Product: EcoStruxure� Power Monitoring Expert 9.0 and prior versions...

CVE-2021-22827

A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits a page containing the injected payload. This CVE is unique from CVE-2021-22826. Affected Product: EcoStruxure� Power Monitoring Expert 9.0 and prior versions...

CVE-2021-22826

A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits a page containing the injected payload. This CVE is unique from CVE-2021-22827. Affected Product: EcoStruxure� Power Monitoring Expert 9.0 and prior versions...

Input validation

A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits a page containing the injected payload. This CVE is unique from CVE-2021-22826. Affected Product: EcoStruxure? Power Monitoring Expert 9.0 and prior versions...

CVE-2021-22826

The connected Red Hat entries confirm CVE-2021-22826 is an input-validation flaw (CWE-20) in EcoStruxure Power Monitoring Expert 9.0 and earlier. The vulnerability allows arbitrary code execution when a user visits a page containing the injected payload. The issue is tied to CVE-2021-22827 as a s...