Bento4 安全漏洞

Bento4 is an open source C++ library for reading and writing MP4 files. A security vulnerability exists in Bento4, which stems from an unknown handler in its mp4decrypt component that allows an attacker to implement a memory leak. The attack method is publicly available and can be initiated...

Bento4 安全漏洞

Bento4 is an open source C++ library for reading and writing MP4 files. A security vulnerability exists in Bento4, which stems from an unknown function in its mp4mux component that allows an attacker to implement a memory leak. The attack method is publicly available and can be initiated remotely...

CVE-2022-41776

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to trigger the WriteConfiguration method, which could allow an attacker to provide new values for user configuration files such as UserListInfo.xml. This could lead to the changing of administrativ...

CVE-2022-41776

Delta Electronics InfraSuite Device Master versions 00.00.01a and older expose WriteConfiguration without authentication, enabling an attacker to alter user configuration files (e.g., UserListInfo.xml) and potentially change administrative passwords. Multiple sources (NVD, Red Hat CVE page, ZDI a...

LodePNG 缓冲区错误漏洞

LodePNG is a PNG encoder and decoder in C and C++ by the individual developer Lode Vandevenne. A security vulnerability exists in LodePNG version v20220717, which stems from a segmentation exception in the pngdetail method...

Advantech iView Directory Traversal (CVE-2022-2139)

A directory traversal vulnerability exists in Advantech iView. The vulnerability is due to improper validation of user-supplied path before using in findCfgDeviceListDetailsExport method...

Oracle.sol uses deprecated Chainlink method latestAnswer()

Lines of code Vulnerability details Proof of Concept Chainlink has market the latestAnswer method as deprecated for his price feeds, but the code is using it. Impact The latestAnswer method just returns the price and has no way to check if it is stale. If the project is using a stale price it can...

OESA-2022-2022 libX11 security update

The libX11-devel package contains libraries and header files for libX11. Security Fixes: A vulnerability was found in X.org libX11 and classified as problematic. This issue affects the function XFreeX11XCBStructure of the file xcbdisp.c. The manipulation of the argument dpy leads to memory leak. ...

httpd: Request splitting via HTTP/2 method injection and mod_proxy

A NULL pointer dereference was found in Apache httpd modh2. The highest threat from this flaw is to system integrity...

httpd: Request splitting via HTTP/2 method injection and mod_proxy

A NULL pointer dereference was found in Apache httpd modh2. The highest threat from this flaw is to system integrity...

PT-2022-23622 · Algosec · Algosec Fireflow

Name of the Vulnerable Software and Affected Versions: AlgoSec FireFlow affected versions not specified Description: The issue involves a Reflected Cross-Site-Scripting RXSS attack. A malicious user can inject JavaScript code into the IntersectudRule parameter on the "search/result.html" page. By...

Friday Squid Blogging: The Reproductive Habits of Giant Squid

Interesting: A recent study on giant squid that have washed ashore along the Sea of Japan coast has raised the possibility that the animal has a different reproductive method than many other types of squid. Almost all squid and octopus species are polygamous, with multiple males passing sperm to ...

Upgraded Q -> M from 236 [1666363743332]

Judge has assessed an item in Issue 236 as Medium risk. The relevant finding follows: ERC721 token can be lost in fillAsk PROBLEM When a user fills an ask order by calling fillAsk, the ERC721.transferFrom method is used to transfer the NFT to the receiver. Should the receiver be a smart contract...

UBUNTU-CVE-2022-43034

An issue was discovered in Bento4 v1.6.0-639. There is a heap buffer overflow vulnerability in the AP4BitReader::SkipBitsunsigned int function in mp42ts...

Researchers: Office 365 Encryption Flaw Compromise Message Confidentiality

By Deeba Ahmed According to researchers, the security flaw can be exploited for inferring message contents due to the flawed Office 365 Message Encryption OME security method. This is a post from HackRead.com Read the original post: Researchers: Office 365 Encryption Flaw Compromise Message...

CVE-2022-41316

A flaw was found in HashiCorp Vault and Vault Enterprise. Vault’s TLS certificate auth method did not initially load the optionally-configured CRL issued by the role’s Certificate Authority CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been...

WiFi File Transfer 1.0.8 Cross Site Scripting

Document Title: =============== WiFi File Transfer v1.0.8 - Cross Site Scripting Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2322 Release Date: ============= 2022-10-17 Vulnerability Laboratory ID VL-ID:...

MGASA-2022-0367 Updated python packages fix security vulnerability

The mailcap module does not add escape characters into commands discovered in the system mailcap file. CVE-2015-20107 Allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. CVE-2021-4189 The urlparse method does not...

Updated python packages fix security vulnerability

The mailcap module does not add escape characters into commands discovered in the system mailcap file. CVE-2015-20107 Allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. CVE-2021-4189 The urlparse method does not...

Denial Of Service (DoS)

org.ini4j:ini4j is vulnerable to Denial of Service DoS attacks. The vulnerability is due to the fetch method in BasicProfile.java lacking circular dependency checks, which allows an attacker to cause a stack overflow exception resulting in Denial of Service. While the CVE claims that v0.5.4 is...