CVE-2022-24740

Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authentication cookie replaced with an authentication cookie from another user, effectively giving them control of the other user's account and...

PT-2022-16843

Name of the Vulnerable Software and Affected Versions Volto versions 14.0.0-alpha.5 through 15.0.0-alpha.0 Description The issue occurs when using an outdated version of the react-cookie library and a server is under high load, allowing a user's authentication cookie to be replaced with another...

PT-2022-36868

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN READ. The crash state involves functions such as pdfi fapi get glyph, get fapi glyph data, and cff slot loa...

Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory.

...

Samsung Bixby Touch security vulnerability

An access control error vulnerability exists in Samsung Bixby Touch, a virtual intelligent assistant for Samsung mobile devices, which stems from a failure to properly restrict access to resources from unauthorized roles in Bixby Touch. An attacker could exploit the vulnerability to allow untrust...

PT-2022-36865

Name of the Vulnerable Software and Affected Versions vips affected versions not specified Description The issue is related to a heap-buffer-overflow read, which occurs in the vips rect intersectrect function, specifically when calling vips foreign load pdf generate and vips region prepare to...

CVE-2022-25824: Improper Access Control

Improper access control vulnerability in BixbyTouch prior to version 2.2.00.6 in China models allows untrusted applications to load arbitrary URL and local files in webview...

PT-2022-17550 · Samsung · Bixbytouch

Name of the Vulnerable Software and Affected Versions: BixbyTouch versions prior to 2.2.00.6 Description: The issue is related to improper access control, allowing untrusted applications to load arbitrary URL and local files in webview. Recommendations: For versions prior to 2.2.00.6, update to...

CVE-2021-24825

The Custom Content Shortcode WordPress plugin before 4.0.2 does not validate the data passed to its load shortcode, which could allow Contributor+ v 4.0.1 or Admin+ v 4.0.2 users to display arbitrary files from the filesystem such as logs, .htaccess etc, as well as perform Local File Inclusion...

PT-2022-36862

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a stack-buffer-overflow crash. Technical details include a crash type of Stack-buffer-overflow WRITE 1, with the crash state...

PT-2022-36861

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN READ. The crash state involves several functions: pdfi read cff font, pdfi load font, and pdfi read type0...

CVE-2021-3656

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB virtual machine control block provided by the L1 guest to spawn/handle a nested guest L2. Due to improper validation of the "virtext" field, this issue could allow a malicious...

PT-2025-8176

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the version that includes the fix for the uninitialized flag for AV/C deferred transaction Description The issue is related to an uninitialized flag for AV/C deferred transactions in the Linux kernel. The problem...

PT-2022-36857

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A crash occurred due to an unknown read issue. The crash state indicates a problem with loading a font, specifically involving the functions pdfi count cff...

CVE-2021-23191

A security issue was found in htmldoc v1.9.12 and before. A NULL pointer dereference in the function imageloadjpeg in image.cxx may result in denial of service...

AZL-8871 CVE-2022-25634 affecting package qt5-qtsvg for versions less than 5.12.11-3

Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory...

Access to XMLHTTPRequest at <URL> from origin <URL>has been blocked by CORS policy

When navigating to load balanced VIP, 'Cannot Complete Your Request' is seen .HAR file will showAccess to XMLHTTPRequest at from origin has been blocked by CORS policy...

PT-2022-28887

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.16 through v5.16.4 Description The issue is related to the load unaligned zeropad function in the arm64 extable. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

Air Cargo Management System v1.0 - SQLi

Title: Air Cargo Management System v1.0 - SQLi Author: nu11secur1ty Date: 02.18.2022 Vendor: https://www.sourcecodester.com/users/tips23 Software: https://www.sourcecodester.com/php/15188/air-cargo-management-system-php-oop-free-source-code.html Reference:...

unbound: integer overflow in a size calculation in dnscrypt/dnscrypt.c

A flaw was found in unbound. An integer overflow in dnscloadlocaldata function may lead to a buffer overflow of the allocated buffer if the size can be controlled by an attacker. The highest threat from this vulnerability is to data confidentiality and integrity as well as service availability...