2787 matches found
Unrestricted file upload
VMware Carbon Black App Control 8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2 contains a file upload vulnerability. A malicious actor with administrative access to the VMware App Control administration interface may be able to execute code on the Windo...
CVE-2022-22952
VMware Carbon Black App Control 8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2 contains a file upload vulnerability. A malicious actor with administrative access to the VMware App Control administration interface may be able to execute code on the Windo...
CVE-2022-25225
Network Olympus version 1.8.0 allows an authenticated admin user to inject SQL queries in '/api/eventinstance' via the 'sqlparameter' JSON parameter. It is also possible to achieve remote code execution in the default installation PostgreSQL by exploiting this issue...
Network Olympus SQL注入漏洞
Network Olympus is Softinventive Lab's enterprise network for agentless monitoring. Network Olympus version 1.8.0 is vulnerable to SQL injection, which stems from a missing sqlparameter JSON parameter in /api/eventinstance validation of external input SQL statements. An attacker could exploit thi...
Privilege Escalation
github.com/tharsis/evmos is vulnerable to privilege escalation. An attacker is able to drain unclaimed funds from user addresses by creating a new chain which does not enforce signature verification and connecting it to the targeted victim's evmos instance...
Invalid drop of partially-initialized instances in the pooling instance allocator for modules with defined `externref` globals
Impact There exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an externref global will result in an invalid drop of a VMExternRef via an uninitialized pointer. As instance slots may be reused between...
Default configuration
Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an externref global will result in an invalid drop of a...
CVE-2022-23636
Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an "externref" global will result in an invalid drop of a...
CVE-2022-23636 Invalid drop of partially-initialized instances in wasmtime
Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an externref global will result in an invalid drop of a...
CVE-2022-23636
Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an externref global will result in an invalid drop of a...
CVE-2022-23636 Invalid drop of partially-initialized instances in wasmtime
Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an externref global will result in an invalid drop of a...
PT-2022-16149
Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 0.34.1 and 0.33.1 Description A bug exists in the pooling instance allocator in Wasmtime's runtime. When a failure to instantiate an instance for a module that defines an externref global occurs, it results in an...
CVE-2022-23636: Access of Uninitialized Pointer
Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an externref global will result in an invalid drop of a...
wasmtime:instantiate-many: Segv on unknown address in core::ptr::drop_in_place$LT$wasmtime_runtime..instance..Instance$GT$::h41cb0d5e5
Project: https://github.com/bytecodealliance/wasmtime.git Detailed Report: https://oss-fuzz.com/testcase?key=5305807502180352 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: instantiate-many Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: Segv on unknown address Crash...
TikTok: Instance Page DOS within Organization on TikTok Ads
A vulnerability was found on the Instance Page service of TikTok Ads, which would allow an Operator to perform a Denial of Service DoS on the Front End of only their own organization. We thank @arsenelupin for reporting this to our team...
CVE-2022-24961
In Portainer Agent before 2.11.1, an API server can continue running even if not associated with a Portainer instance in the past few days...
Unauthorized access to Class instance in Jinjava
Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure...
Veeam Service Provider Console fails to connect to restored VSPC database due to collation conflict
Challenge When attempting to connect Veeam Service Provider Console to an existing VSPC database the following error occurs: Implicit conversion of varchar value to varchar cannot be performed because the collation of the value is unresolved due to a collation conflict between "" and "" in add...
F5 NGINX Controller API Code Injection Vulnerability
The F5 NGINX Controller is a self-service, API-driven platform for managing NGINIX Plus that can be easily integrated into CI/CD workflows to accelerate application deployment and simplify application lifecycle management. user" or "admin" role access and authenticated attackers can use an...