CVE-2022-43572 Indexing blockage via malformed data sent through S2S or HEC protocols in Splunk Enterprise

In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, sending a malformed file through the Splunk-to-Splunk S2S or HTTP Event Collector HEC protocols to an indexer results in a blockage or denial-of-service preventing further indexing...

PT-2022-24202 · Cms800 +1 · Cms800 +1

Name of the Vulnerable Software and Affected Versions: CMS800 affected versions not specified CME8000 affected versions not specified Description: The issue arises when the device attempts to parse malformed network data sent by a threat actor. A threat actor with network access can remotely issu...

CVE-2022-3029

In NLnet Labs Routinator 0.9.0 up to and including 0.11.2, due to a mistake in error handling, data in RRDP snapshot and delta files that isn’t correctly base 64 encoded is treated as a fatal error and causes Routinator to exit. Worst case impact of this vulnerability is denial of service for the...

Bentley Systems MicroStation和Bentley View 缓冲区错误漏洞

Bentley Systems MicroStation and Bentley View are both products of Bentley Systems, Inc. of the U.S.A. MicroStation is a Cad software platform for 2D and 3D design and drafting.Bentley View is a freeware viewer. A security vulnerability exists in Bentley Systems MicroStation version 10.16. and...

The vulnerability of the Security Intelligence channel function in Cisco Firepower Threat Defense’s microprogramming-based network interface devices allows attackers to bypass the DNS channel of Security Intelligence.

The vulnerability of the Security Intelligence channel function in Cisco Firepower Threat Defense’s microprogramming system is related to the improper processing of unexpected data types. Exploiting this vulnerability can allow a malicious actor to bypass the Security Intelligence DNS channel by...

GHSA-MCQ2-W56R-5W2W Daemon panics when processing certain blocks

Impact go-ipfs nodes with versions 0.10.0, 0.11.0, 0.12.0, or 0.12.1 can crash when trying to traverse certain malformed graphs due to an issue in the go-codec-dagpb dependency. Vulnerable nodes that work with these malformed graphs may crash leading to denial-of-service risks. This particularly...

CVE-2022-20750

A vulnerability in the checkpoint manager implementation of Cisco Redundancy Configuration Manager RCM for Cisco StarOS Software could allow an unauthenticated, remote attacker to cause the checkpoint manager process to restart upon receipt of malformed TCP data. This vulnerability is due to...

Cisco StarOS 输入验证错误漏洞

Cisco RCM for Cisco StarOS Software is a denial-of-service vulnerability that could be exploited to cause the checkpoint manager process to restart upon receipt of malformed TCP data...

Information disclosure

In Linaro OP-TEE before 3.7.0, by using inconsistent or malformed data, it is possible to call update and final cryptographic functions directly, causing a crash that could leak sensitive information...

CVE-2021-21564

Dell OpenManage Enterprise versions prior to 3.6.1 contain an improper authentication vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to hijack an elevated session or perform unauthorized actions by sending malformed data...

Dell OpenManage Enterprise 授权问题漏洞

Dell OpenManage Enterprise is an easy-to-use, one-to-many system management console for IT infrastructure management from Dell, Inc. The software supports cost-effective, comprehensive lifecycle management of Dell EMC PowerEdge servers in a single console. An unauthenticated remote attacker could...

CVE-2021-31875

In mjsjson.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjsjsonparse, which can potentially lead to redirection of control flow. NOTE: the original reporter disputes the significance of this finding because "there isn’t...

CVE-2021-25214

In BIND 9.8.5 - 9.8.8, 9.9.3 - 9.11.29, 9.12.0 - 9.16.13, and versions BIND 9.9.3-S1 - 9.11.29-S1 and 9.16.8-S1 - 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 - 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a malform...

decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer with a resultant invalid free or segmentation fault via malformed gzip data.

...

PT-2021-2871 · Busybox +4 · Busybox +4

Name of the Vulnerable Software and Affected Versions: BusyBox versions 1.32.1 and earlier Description: The issue is related to the decompress gunzip.c file in BusyBox, which mishandles the error bit on the huft build result pointer. This can lead to an invalid free or segmentation fault when...

IBM MQ Internet Pass-Thru Denial of Service Vulnerability

IBM MQ Internet Pass-Thru is an American IBM product used to support the realization of messaging between remote sites on the Internet. The product is an extended functionality component of IBM MQ that acts as a protocol channel or proxy for establishing protocols during interactions, making it...

IBM MQ Internet Pass-Thru 资源管理错误漏洞

IBM MQ Internet Pass-Thru is an American IBM product used to support the realization of messaging between remote sites on the Internet. The product is an extended functionality component of IBM MQ that acts as a protocol channel or proxy for establishing protocols during interactions, making it...

SAP 3D Visual Enterprise Viewer Input Validation Error Vulnerability (CNVD-2020-74930)

SAP 3D Visual Enterprise Viewer is an application from SAP Germany. This product increases resource utilization by extending the uptime of essential products and assets whenever and wherever they are needed. A security vulnerability exists in SAP 3D visual Enterprise Viewer version-9 that...

CVE-2020-1890

A URL validation issue in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have caused the recipient of a sticker message containing deliberately malformed data to load an image from a sender-controlled URL without user interaction...

CVE-2020-10894

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists with...