CVE-2017-20041 Ucweb UC Browser HTML URL improper restriction of rendered ui layers

A vulnerability was found in Ucweb UC Browser 11.2.5.932. It has been classified as critical. Affected is an unknown function of the component HTML Handler. The manipulation of the argument title leads to improper restriction of rendered ui layers URL. It is possible to launch the attack remotely...

WordPress plugin Google Tag Manager 跨站脚本漏洞

WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin Google Tag Manager version 1.15 has a cross-site scripting vulnerability that stems from the fact that site searches are n...

PT-2022-14060

Name of the Vulnerable Software and Affected Versions Google Tag Manager for WordPress plugin for WordPress versions up to and including 1.15 Description The issue is related to reflected Cross-Site Scripting via the s parameter, which is caused by insufficient sanitization in the site search...

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However several TLS andSSH settings were left out from the configuration match checks making themmatch too easily.

...

Researchers Find Bluetooth Signals Can be Fingerprinted to Track Smartphones

A new research undertaken by a group of academics from the University of California San Diego has revealed for the first time that Bluetooth signals can be fingerprinted to track smartphones and therefore, individuals. The identification, at its core, hinges on imperfections in the Bluetooth...

Q1 2022 Global DDoS Threat Landscape Report Findings Summary

Last week, Imperva released the Q1 2022 Global DDoS Threat Landscape Report. To produce the report’s findings, Imperva performs detailed statistical analysis of all DDoS activity that our Threat Research Labs monitored from our global network of PoPs during the first three months of 2022. In...

OESA-2022-1698 webkit2gtk3 security update

WebKitGTK is a full-featured port of the WebKit rendering engine, suitable for projects requiring any kind of web integration, from hybrid HTML/CSS applications to full-fledged web browsers. This package contains WebKit2 based WebKitGTK+ for GTK+ 3. Security Fixes: In WebKitGTK through 2.36.0 and...

RLSA-2022:4899 Important: compat-openssl11 security and bug fix update

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. compat-openssl11 provides the legacy 1.1 version of OpenSSL for use with older binaries. Security Fixes: openssl: Infinite...

CVE-2022-27782

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH...

ALPINE-CVE-2022-27782

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH...

AZL-9877 CVE-2022-27782 affecting package curl for versions less than 7.83.1-1

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH...

DEBIAN-CVE-2022-27782

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH...

CVE-2022-27782

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH...

Griefing Attack By Extending The Reward Duration

Lines of code Vulnerability details Proof-Of-Concept The Gauge.notifyRewardAmount notifies the contract of a newly received rewards. This updates the local accounting and streams the reward over a preset period Five days. It was observed that this function is callable by anyone regardless of...

OESA-2022-1675 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: libcurl would reuse a previously created connection even when a TLS or SSH related option had been changed that should have prohibited reuse...

The vulnerability of the llcp_sock_bind() function in the NFC protocol of the Linux operating system allows a hacker to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the llcpsockbind function in the NFC protocol of the Linux operating system’s kernel is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker acting locally to gain access to confidential data, compromise its integrity, and cause...

CVE-2021-32966

Philips Interoperability Solution XDS versions 2.5 through 3.11 and 2018-1 through 2021-1 are vulnerable to clear text transmission of sensitive information when configured to use LDAP via TLS and where the domain controller returns LDAP referrals, which may allow an attacker to remotely read LDA...

Uncaught Exception

Overview std/crypto/dsa is a Go standard library package std/crypto/dsa Affected versions of this package are vulnerable to Uncaught Exception. Go Vulnerability Report: via the dsa.Verify function. An attacker can cause a panic and potentially crash the application by submitting a crafted DSA...

Mattermost Server does not check if cookies are used over SSL

An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL...

GHSA-5H29-QQ92-WJ7F Cleartext Transmission of Sensitive Information in Apache MINA

Handling of the closenotify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This...