CVE-2022-36099

CVE-2022-36099 affects XWiki Platform Wiki UI Main Wiki. Affected: XWiki Platform versions 5.3-milestone-2 up to but not including 13.10.6 and 14.4. Root cause: via the request URL parameter, an attacker can inject arbitrary wiki syntax using the XWikiServerClassSheet when the attacker has view a...

EUVD-2022-6981

XWiki Platform Wiki UI Main Wiki is software for managing subwikis on XWiki Platform, a generic wiki platform. Starting with version 5.3-milestone-2 and prior to versions 13.10.6 and 14.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the...

The art and science behind Microsoft threat hunting: Part 1

At Microsoft, we define threat hunting as the practice of actively looking for cyberthreats that have covertly or not so covertly penetrated an environment. This involves looking beyond the known alerts or malicious threats to discover new potential threats and vulnerabilities. Why do incident...

TOTOLINK A860R downloadfile.cgi Buffer Overflow Vulnerability

TOTOLINK A860R is a dual-band wireless router with a maximum transmission rate of 1200Mbps, 6-antenna dual-band concurrent technology, and support for remote management by mobile APP, which is suitable for small and medium-sized enterprises and home network environments. TOTOLINK A860R suffers fr...

SUSE-SU-2022:3137-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: - Updated to version 2.36.7 bsc1202807: - CVE-2022-32893: Fixed an issue that would be triggered when processing malicious web content and that could lead to arbitrary code execution. - Fixed several crashes and rendering issues. - Updated t...

TOTOLINK A860R 安全漏洞

TOTOLINK A860R is a dual-band wireless router with a maximum transmission rate of 1200Mbps, 6-antenna dual-band concurrent technology, and support for remote management by mobile APP, which is suitable for small and medium-sized enterprises and home network environments. TOTOLINK A860R suffers fr...

WordPress plugin Stockists Manager for Woocommerce 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2022-1355

A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main function. This flaw allows an attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue, possibly corrupting the memory, and causing a crash that leads to a denial of service...

CVE-2022-37056

D-Link GO-RT-AC750 GORTAC750revAv101b03 and GO-RT-AC750revBFWv200b02 is vulnerable to Command Injection via /cgibin, hnapmain,...

CVE-2022-37055

D-Link Go-RT-AC750 GORTAC750revAv101b03 and GO-RT-AC750revBFWv200b02 are vulnerable to Buffer Overflow via cgibin, hnapmain,...

PT-2022-23772

Name of the Vulnerable Software and Affected Versions D-Link Go-RT-AC750 versions GORTAC750 revA v101b03 and GO-RT-AC750 revB FWv200b02 Description The D-Link Go-RT-AC750 is susceptible to a buffer overflow condition. This issue is triggered through the cgibin and hnap main components...

PT-2022-23773

Name of the Vulnerable Software and Affected Versions D-Link GO-RT-AC750 version GORTAC750 revA v101b03 D-Link GO-RT-AC750 version GO-RT-AC750 revB FWv200b02 Description The issue allows for Command Injection via cgibin and ssdpcgi main. Recommendations For version GORTAC750 revA v101b03, conside...

PT-2022-7699

Name of the Vulnerable Software and Affected Versions D-Link GO-RT-AC750 versions GORTAC750 revA v101b03 through GO-RT-AC750 revB FWv200b02 Description The issue is related to the hnap main function of the D-Link GO-RT-AC750 router's firmware, which fails to neutralize special elements used in an...

ALPINE-CVE-2022-38533

In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfdgetl32 when called from the stripmain function in strip-new via a crafted file...

CVE-2022-35008

PNGDec commit 8abf6be was discovered to contain a stack overflow via /linux/main.cpp...

CVE-2022-35013

PNGDec commit 8abf6be was discovered to contain a FPE via SaveBMP at /linux/main.cpp...

PNGDec 缓冲区错误漏洞

PNGDec is an Arduino PNG image decoder library from the individual developer Larry Bank. A security vulnerability exists in PNGDec that stems from a heap buffer overflow in SaveBMP in the /linux/main.cpp file...

PNGDec 缓冲区错误漏洞

PNGDec is an Arduino PNG image decoder library from the individual developer Larry Bank. A security vulnerability exists in PNGDec, which stems from a stack overflow issue in /linux/main.cpp...

PNGDec 资源管理错误漏洞

PNGDec is an Arduino PNG image decoder library from the individual developer Larry Bank. A security vulnerability exists in PNGDec that stems from a floating point exception in SaveBMP in the /linux/main.cpp file...

DEBIAN-CVE-2022-35978

Minetest is a free open-source voxel game engine with easy modding and game creation. In single player, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs i...