14256 matches found
PT-2022-28735
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.25 Description A data-race issue exists in the fib6 info hw flags set and fib6 purge rt functions. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versio...
CVE-2022-25331
Uncaught exceptions that can be generated in Trend Micro ServerProtection 6.0/5.8 Information Server could allow a remote attacker to crash the process...
PYSEC-2022-33
b2-sdk-python is a python library to access cloud storage provided by backblaze. Linux and Mac releases of the SDK version 1.14.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a time-of-check-time-of-use TOCTOU race...
Security Bulletin: Vulnerabilities in unzip affect IBM Security Network Intrusion Prevention System (CVE-2014-8139, CVE-2014-8140, CVE-2014-8141, and CVE-2014-9636 )
Summary The unzip utility is used to list, test, or extract files from a zip archive. Security vulnerabilities have been discovered in unzip used with IBM Security Network Intrusion Prevention System. Vulnerability Details CVE ID: CVE-2014-8139 DESCRIPTION: Info-ZIP UnZip is vulnerable to a...
PT-2022-16163
Name of the Vulnerable Software and Affected Versions B2 Command Line Tool versions 3.2.0 and below Description The B2 Command Line Tool contains a key disclosure vulnerability that can be exploited by local attackers through a time-of-check-time-of-use TOCTOU race condition. The tool saves API...
USN-5302-1 linux-oem-5.14 vulnerabilities
Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the Linux kernel did not properly restrict access to the cgroups v1 releaseagent feature. A local attacker could use this to gain administrative privileges. CVE-2022-0492 Brendan Dolan-Gavitt discovered that the Marvell WiFi-Ex...
VulnCheck KEV: CVE-2020-11984
Apache HTTP server 2.4.32 to 2.4.44 modproxyuwsgi info disclosure and possible RCE...
TotoLink router command injection vulnerabilities
TOTOLink T6 is a wireless dual-band router from TotoLink, China. recvmeshinfosync function of TOTOLink T6 is vulnerable to command injection. An attacker can exploit this vulnerability to execute arbitrary commands via specially crafted MQTT packets...
CVE-2022-24061
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...
PT-2022-17092
Name of the Vulnerable Software and Affected Versions TOTOLINK Technology router T6 V3 Firmware version T6 V3 V4.1.5cu.748 B20211015 Description A command injection issue in the recv mesh info sync function allows attackers to execute arbitrary commands via a crafted MQTT packet. This can be...
PT-2022-13320
Name of the Vulnerable Software and Affected Versions url-parse versions prior to 1.5.7 Description The issue allows for authorization bypass through a user-controlled key. A specially crafted URL with an '@' sign but empty user info and no hostname, when parsed with url-parse, will return the...
empire.enguehard.info Cross Site Scripting vulnerability OBB-2375070
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
unzip buffer overflow vulnerability (CNVD-2022-11523)
Info-ZIP UnZip is a Unix-based tool for decompressing ".zip" file formats developed by Greg Roelofs. unzip is vulnerable to a buffer overflow vulnerability that results from the conversion of utf-8 strings to native strings resulting in a segmentation error. An attacker could exploit this...
Information disclosure
The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security risk if information-disclosure auditing processes rely on a clone operation without the --mirror option...
PT-2022-13257 · Subiquity · Subiquity
Name of the Vulnerable Software and Affected Versions: Subiquity affected versions not specified Description: The issue concerns Subiquity showing guided storage passphrases in plaintext with read-all permissions. Recommendations: At the moment, there is no information about a newer version that...
PT-2022-16723 · Unknown · Novel-Plus
Name of the Vulnerable Software and Affected Versions: Novel-plus version 3.6.0 Description: The issue is related to Server-Side Request Forgery SSRF that can be triggered via user-supplied crafted input. Recommendations: For Novel-plus version 3.6.0, update to a version that fixes the Server-Sid...
Input validation
Improper conditions check in the IntelR IPP Crypto library before version 2021.2 may allow an authenticated user to potentially enable information disclosure via local access...
GHSA-3H2H-XQR2-2JP7 Cross-site Scripting (XSS) in Apache ActiveMQ Artemis
In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and th...
CVE-2022-21660 Missing authorization in gin-vue-admin
Gin-vue-admin is a backstage management system based on vue and gin. In versions prior to 2.4.7 low privilege users are able to modify higher privilege users. Authentication is missing on the setUserInfo function. Users are advised to update as soon as possible. There are no known workarounds...