11366 matches found
GSD-2022-1004167 KVM: x86: Fully initialize 'struct kvm_lapic_irq' in kvm_pv_kick_cpu_op()
KVM: x86: Fully initialize 'struct kvmlapicirq' in kvmpvkickcpuop This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.13 by commit...
[SECURITY] Fedora 36 Update: golang-github-google-wire-0.5.0-4.fc36
Wire is a code generation tool that automates connecting components using dependency injection. Dependencies between components are represented in Wire as function parameters, encouraging explicit initialization instead of global variables. Because Wire operates without runtime state or reflectio...
Ubuntu 16.04 ESM : Intel Microcode vulnerabilities (USN-5535-1)
The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5535-1 advisory. Joseph Nuzman discovered that some Intel processors did not properly initialise shared resources. A local attacker could use this to obtain sensitive...
CVE-2022-30271
The Motorola ACE1000 RTU through 2022-05-02 ships with a hardcoded SSH private key and initialization scripts such as /etc/init.d/sshdservice only generate a new key if no private-key file exists. Thus, this hardcoded key is likely to be used by default...
CVE-2022-30271
The CVE-2022-30271 entry concerns Motorola Solutions ACE1000 RTU (through 2022-05-02) shipping with a hardcoded SSH private key. Red Hat and CISA advisories confirm the root cause: the initialization scripts (e.g., /etc/init.d/sshd_service) do not generate a new key if a private-key file exists, ...
CVE-2022-30271
The Motorola ACE1000 RTU through 2022-05-02 ships with a hardcoded SSH private key and initialization scripts such as /etc/init.d/sshdservice only generate a new key if no private-key file exists. Thus, this hardcoded key is likely to be used by default...
DEBIAN-CVE-2022-26306
LibreOffice supports the storage of passwords for web connections in the userās configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which...
Design/Logic Flaw
LibreOffice supports the storage of passwords for web connections in the userās configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which...
properties-reader security vulnerability
properties-reader is a Node.js property reader compatible with ini files by Steve King, a personal developer. A security vulnerability exists in properties-reader prior to version 2.2.0, which stems from the package's susceptibility to prototype contamination, and which can be exploited by an...
CVE-2022-26306
LibreOffice supports the storage of passwords for web connections in the userās configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which...
CVE-2022-26306
LibreOffice supports the storage of passwords for web connections in the userās configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which...
ion-parser security vulnerability
ion-parser is 418sec open source one of the fastest and lightest Javascript parser for TOML and ION files . A security vulnerability exists in ion-parser that stems from the package's susceptibility to prototype contamination, which can be exploited by an attacker to submit malicious INI files to...
LibreOffice security feature vulnerability
LibreOffice is an open source office software suite from The Document Foundation tdf. The product includes applications such as Writer text documents, Calc spreadsheets, and Impress presentations.LibreOffice is vulnerable to an encryption problem that stems from LibreOffice using weak...
mruby:mruby_fuzzer: Index-out-of-bounds in str_init_embed
Project: https://github.com/mruby/mruby.git Detailed Report: https://oss-fuzz.com/testcase?key=4876299788746752 Project: mruby Fuzzing Engine: libFuzzer Fuzz Target: mrubyfuzzer Job Type: libfuzzerubsanmruby Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State: strinitemb...
Intel RealSense ID Solution F450 Disclosure
The vulnerability of the microprogramming software in the integrated facial authentication module of Intel RealSense ID Solution F450 is related to initialization errors. Exploiting this vulnerability can allow attackers to disclose protected information...
New Linux Malware Framework Lets Attackers Install Rootkit on Targeted Systems
A never-before-seen Linux malware has been dubbed a "Swiss Army Knife" for its modular architecture and its capability to install rootkits. This previously undetected Linux threat, called Lightning Framework by Intezer, is equipped with a plethora of features, making it one of the most intricate...
PT-2025-26095
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A fix has been applied to the Linux kernel to address an information leak issue in the wil write file wmi function. The problem occurred because the simple write to buffer function...
Firefox Thunderbird DoS
The vulnerabilities of Firefox browsers, Firefox ESR, and the email client Thunderbird are related to errors during initialization. Exploiting these vulnerabilities can allow a malicious actor to trigger service interruptions by using a specially created message...
[SECURITY] Fedora 35 Update: golang-github-google-wire-0.4.0-6.fc35
Wire is a code generation tool that automates connecting components using dependency injection. Dependencies between components are represented in Wire as function parameters, encouraging explicit initialization instead of global variables. Because Wire operates without runtime state or reflectio...
Vault implementation can be selfdestructed due to lack of initialization
Lines of code Vulnerability details Impact HIGH - Assets can be lost directly Anybody can initialize the Vault's implementation contract. The worst case would be to selfdestruct and make all the already deployed and to be deployed Vault's proxies useless and assets in the deployed proxies will be...