CVE-2021-26384: Out-of-bounds Read

A malformed SMI System Management Interface command may allow an attacker to establish a corrupted SMI Trigger Info data structure, potentially leading to out-of-bounds memory reads and writes when triggering an SMI resulting in a potential loss of resources...

WhatsApp warns users: Fake versions of WhatsApp are trying to steal your personal info

WhatsApp boss Will Cathcart is warning users of the popular messaging app to be on their guard after the WhatsApp Security Team discovered bogus apps packing a hidden punch in the form of malware. Outside the safety of the walled garden App stores do whatever they can to try and prevent bogus...

CVE-2022-33676

creationtimestamp| type| source ---|---|--- 2022-07-13 02:31:44+00:00| seen| https://t.me/cibsecurity/46135...

CVE-2022-30187

CVE-2022-30187 concerns the Microsoft Azure Storage Library (client-side encryption) where a padding-oracle/information-disclosure issue could allow a local, authenticated attacker to bypass confidentiality restrictions. Public references describe it as an Authorization/Confidentiality impact in ...

CVE-2022-21845 Windows Kernel Information Disclosure Vulnerability

...

PT-2022-3678 · Microsoft · Windows Fax Service +1

Name of the Vulnerable Software and Affected Versions: Windows Fax Service affected versions not specified Description: The issue is related to incorrect code generation management in the Windows Fax Service, which can be exploited by remote attackers to execute arbitrary code and affect the...

Novastar-VNNOX-iCare Novaicare security vulnerability

Novastar-VNNOX-iCare Novaicare is an application used to centrally monitor the status of LED screen displays by Xi'an Novaicare Technology Co. in China. A security vulnerability exists in Novastar-VNNOX-iCare Novaicare version 7.16.0, which can be exploited by an attacker to elevate privileges an...

Security Bulletin: IBM Security Verify Information Queue uses a dom4j version with improper XXE restrictions (CVE-2020-10683)

Summary The products image in IBM Security Verify Information Queue ISIQ v10.0.2 uses an older version of the dom4j library that does not properly safeguard against XML External Entity XXE attacks. ISIQ v10.0.3 has upgraded its products image to include a newer dom4j level that remediates the...

xml-security: XPath Transform abuse allows for information disclosure

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any...

For Finserv Ransomware Attacks, Obtaining Customer Data Is the Focus

Welcome back to the third installment of Rapid7's Pain Points: Ransomware Data Disclosure Trends blog series, where we're distilling the key highlights of our ransomware data disclosure research paper one industry at a time. This week, we'll be focusing on the financial services industry, one of...

PT-2022-21083 · Snipe-It · Snipe-It

Name of the Vulnerable Software and Affected Versions: Snipe-IT version 6.0.2 Description: The issue allows attackers to execute arbitrary code via a crafted file, exploiting an arbitrary file upload vulnerability in the Update Branding Settings component. Recommendations: For Snipe-IT version...

Design/Logic Flaw

An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that can delete import information about a user's company...

CVE-2022-21770

CVE-2022-21770 concerns a vulnerability in the sound driver where a symlink following flaw can lead to local information disclosure, with System execution privileges needed. The NVD entry states an impact on confidentiality, integrity, and availability (C/I/A: Partial/Partial/Partial) and a local...

CVE-2022-21763

CVE-2022-21763 affects the telecom service component; due to a missing permission check, it can disclose local information without extra privileges. Exploitation requires no user interaction. A patch is listed (ALPS07044717/ALPS07044708) and updates are reflected in multiple sources (NVD, Red Hat...

Ignition Library info-get Unauthorized Access

The vulnerability of the info-get guestinfo.ignition.config.data configuration implementation in the Ignition library is related to insufficient protection for service data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...

CVE-2022-31599

CVE-2022-31599 affects NVIDIA DGX A100 SBIOS in Ofbd. A local privileged user can cause an uninitialized pointer access, potentially enabling code execution, privilege escalation, DoS, and information disclosure, with impact potentially extending to other components. NVIDIA’s bulletin lists firmw...

PT-2025-26013

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the Linux kernel's arm scpi firmware, where the scpi info is not properly handled when the scpi probe fails. This could result in a use-after-free scenario, as th...

PT-2024-1124

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description The vulnerability is related to insufficient input validation in the libarchive library, which may allow remote attackers to execute arbitrary code. A heap-based out-of-bounds write...

CVE-2022-34785

Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about jobs otherwise inaccessible to them...

barcelonacreativa.info Cross Site Scripting vulnerability OBB-2701159

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...