CVE-2022-41747: Improper Certificate Validation

An improper certification validation vulnerability in Trend Micro Apex One agents could allow a local attacker to load a DLL file with system service privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in...

EulerOS 2.0 SP10 : perl-Encode (EulerOS-SA-2022-2433)

According to the versions of the perl-Encode package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library in th...

EulerOS 2.0 SP10 : perl-Encode (EulerOS-SA-2022-2420)

According to the versions of the perl-Encode package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library in th...

PT-2022-26053 · Trend Micro · Trend Micro Apex One

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex One affected versions not specified Description: The issue is related to an improper certification validation vulnerability in Trend Micro Apex One agents. This could allow a local attacker to load a DLL file with system...

The vulnerability of the system administration program Sudo in the Zimbra Collaboration Suite email management system allows a hacker to increase their privileges.

The vulnerability of the system administration program Sudo in the Zimbra Collaboration Suite email management system is related to deficiencies in access control when processing the binary file NGINX. Exploiting this vulnerability can allow attackers to enhance their privileges by loading...

The vulnerability of the DLL library loading mechanism of the Firefox web browser for Windows allows a hacker to trigger a service failure.

The vulnerability of the Firefox web browser’s DLL library loading mechanism for Windows is related to the absence of quotation marks in the code for elements or search paths. Exploiting this vulnerability can allow an attacker to cause a service failure...

MGASA-2022-0353 Updated libjpeg packages fix security vulnerability

The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer and loading a 16-bit binary PGM file into an RGB buffer. This is related to a heap-based buffer overflow in the getwordrgbrow function in rdppm.c. CVE-2021-468...

CVE-2022-40313

Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load...

Path Traversal

twig/twig is vulnerable to path traversal. The vulnerability exists in findTemplate function of FilesystemLoader.php because the template loading directories are not properly configured which allows an attacker to load templates outside the configured directory...

PT-2022-24824 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.8.9 Discourse versions prior to 2.9.0.beta10 Description: A malicious actor can add large payloads of text into the Location and Website fields of a user profile, causing issues for other users when loading that...

apache-commons-configuration:XMLConfigurationLoadFuzzer: Security exception in java.xml/com.sun.org.apache.xalan.internal.xsltc.trax.DOM2TO.parse

Detailed Report: https://oss-fuzz.com/testcase?key=4553642976083968 Project: apache-commons-configuration Fuzzing Engine: libFuzzer Fuzz Target: XMLConfigurationLoadFuzzer Job Type: libfuzzerasanapache-commons-configuration Platform Id: linux Crash Type: Security exception Crash Address: Crash...

Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute was not blocked

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of when receiving an HTML email that contained an iframe element, which used a srcdoc attribute to define the internal HTML document, remote objects specified in the nested document for example, images or...

freetype2:ftfuzzer: Crash in tt_face_load_svg_doc

Detailed Report: https://oss-fuzz.com/testcase?key=6325475865919488 Project: freetype2 Fuzzing Engine: afl Fuzz Target: ftfuzzer Job Type: aflasanfreetype2 Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x61b002001219 Crash State: ttfaceloadsvgdoc ttglyphload FTLoadGlyph Sanitizer:...

DEBIAN-CVE-2022-38398

Server-Side Request Forgery SSRF vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14...

CVE-2022-38398: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14...

CVE-2022-44011

A heap buffer overflow issue was discovered in ClickHouse server. A malicious user with ability to load data into ClickHouse server could crash the ClickHouse server by inserting a malformed CapnProto object. Fix has been pushed to version 22.9.1.2603, 22.8.2.11, 22.7.4.16, 22.6.6.16, 22.3.12.19...

GHSA-6H2X-4GJF-JC5W autogluon.multimodal vulnerable to unsafe YAML deserialization

Impact A potential unsafe deserialization issue exists within the autogluon.multimodal module, where YAML files are loaded via yaml.load instead of yaml.safeload. The deserialization of untrusted data may allow an unprivileged third party to cause remote code execution, denial of service, and...

GSD-2022-1005702 ALSA: seq: Fix data-race at module auto-loading

ALSA: seq: Fix data-race at module auto-loading This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.142 by commit...

GSD-2022-1005386 ALSA: seq: Fix data-race at module auto-loading

ALSA: seq: Fix data-race at module auto-loading This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.66 by commit...

CVE-2022-2333 Honeywell SoftMaster Uncontrolled Search Path Element

If an attacker manages to trick a valid user into loading a malicious DLL, the attacker may be able to achieve code execution in Honeywell SoftMaster version 4.51 application’s context and permissions...