CVE-2021-4040

A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory OOM condition. This flaw allows an attacker to partially disrupt availability to the broker through a sustained attack of maliciously crafted messages. The highest...

CVE-2021-4040: Uncontrolled Resource Consumption

A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory OOM condition. This flaw allows an attacker to partially disrupt availability to the broker through a sustained attack of maliciously crafted messages. The highest...

CVE-2022-32893

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15.6.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have...

Denial Of Service (DoS)

libtar.so is vulnerable to Denial Of Service DoS. The vulnerability exists due to an out-of-bounds read in variable gnulonglink when size in header struct is set to 0 allowing an attacker to crash the system via a maliciously crafted tar file...

Denial Of Service (DoS)

github.com/caddyserver/caddy is vulnerable to denial of service. The vulnerability exists due to the out-of-bounds read in the Rewrite function of rewrite.go, allowing an attacker to crash the application by providing a maliciously crafted url...

SUSE SLES12 Security Update : webkit2gtk3 (SUSE-SU-2022:2522-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2522-1 advisory. - A cookie management issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina,...

[PNM-003] The preimage DB (i.e., NameWrapper.names) can be maliciously manipulated/corrupted

Lines of code Vulnerability details Description By design, the NameWrapper.names is used as a preimage DB so that the client can query the domain name by providing the token ID. The name should be correctly stored. To do so, the NameWrapper record the domain's name every time it gets wrapped. And...

Cross-site Scripting (XSS)

github.com/zalando/skipper is vulnerable to cross-site scripting. The vulnerability exists due to a lack of sanitization allowing an attacker to bypass a query predicate via a maliciously crafted request...

Null pointer dereference

A maliciously crafted PDF file may be used to dereference a pointer for read or write operation while parsing PDF files in Autodesk Navisworks 2022. The vulnerability exists because the application fails to handle a crafted PDF file, which causes an unhandled exception. An attacker can leverage...

Debian DSA-5154-1 : webkit2gtk - security update

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5154 advisory. The following vulnerabilities have been discovered in the WebKitGTK web engine: CVE-2022-26700 ryuzaki discovered that processing maliciously crafted web...

Input validation

An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. Processing a maliciously crafted AppleScript binary may result in unexpected application termination or disclosure of...

CVE-2022-22662

CVE-2022-22662 is a WebKitGTK/WebKitGTK4 cookie management issue (state management) that may disclose sensitive user information when processing malicious web content. It is fixed by macOS Security Update 2022-003 for Catalina and macOS Big Sur 11.6.5, as cited across multiple sources in the conn...

CVE-2022-22662

A cookie management issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Big Sur 11.6.5. Processing maliciously crafted web content may disclose sensitive user information...

Heap-based Buffer Overflow

pillow is vulnerable to a heap buffer overflow. The vulnerability exists in the ImagingTgaRleDecode of TgaRleDecode.c due to a lack of input validation which allows an attacker to inject maliciously crafted tga image and crash the system...

CVE-2022-26751: Out-of-bounds Write

A memory corruption issue was addressed with improved input validation. This issue is fixed in iTunes 12.12.4 for Windows, iOS 15.5 and iPadOS 15.5, Security Update 2022-004 Catalina, macOS Big Sur 11.6.6, macOS Monterey 12.4. Processing a maliciously crafted image may lead to arbitrary code...

CVE-2022-26748: Out-of-bounds Write

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. Processing maliciously crafted web content may lead to arbitrary code execution...

Denial Of Service (DoS)

@chainsafe/lodestar is vulnerable to denial of service. The vulnerability exists because the library uses the uint64 values as native javascript numbers, allowing an attacker to crash the application by providing large uint64 values greater than 2^53 through the maliciously-crafted AttesterSlashi...

XML External Entity processing vulnerability in Pipeline Maven Integration Jenkins Plugin

An XML external entities XXE vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary directory's content on the agent running the Maven build to have Jenkins parse a maliciously crafted XML file that uses external entities for...

Ops CLI Deserialization of Untrusted Data vulnerability

Ops CLI version 2.0.4 and earlier is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrary code execution when the checkoutrepo function is called on a maliciously crafted file. An attacker can leverage this to execute arbitrary code on the victim machine...

XML Entity Expansion

WSO2 API Manager and API Microgateway are vulnerable to XML Entity Expansion attacks. The vulnerability exists due to XML Entity Expansion attacks and a lack of sanitization allowing an attacker to crash the system via an unauthenticated requests with a maliciously crafted XML file...