Updated google-gson packages fix security vulnerability

The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace method in internal classes, which may lead to DoS attacks. CVE-2022-25647...

The vulnerability of the virNWFilterObjListNumOfNWFilters method in the virtualization management library Libvirt allows a attacker to trigger a service failure.

The vulnerability of the virNWFilterObjListNumOfNWFilters method in the Libvirt virtualization management library is related to insufficient blocking mechanisms. Exploiting this vulnerability allows a remote attacker to cause service failures...

Remote Code Execution

d8sdomains is vulnerable to remote code execution. A potential code-execution backdoor inserted by a third party allows an attacker to upload and execute malicious code on the system under attack, through the vulnerable wrapper method...

Blink1Control2 2.2.7 Weak Password Encryption

// Exploit Title: Blink1Control2 2.2.7 - Weak Password Encryption // Date: 2022-08-12 // Exploit Author: p1ckzi // Vendor Homepage: https://thingm.com/ // Software Link: https://github.com/todbot/Blink1Control2/releases/tag/v2.2.7 // Vulnerable Version: blink1control2 !/usr/bin/env node const...

[NAZ-H2] withdraw() does not update allowances

Lines of code Vulnerability details Impact withdraw is meant for the owner or approved receiver to withdraw the owner's deposited assets and burn the owner's shares. Since it does this for all of the owner's shares, the approved receiver should not be approved for all anymore after burning. Proof...

linked_list_allocator vulnerable to out-of-bound writes on `Heap` initialization and `Heap::extend`

Impact What kind of vulnerability is it? Who is impacted? This vulnerability impacts all the initialization functions on the Heap and LockedHeap types, including Heap::new, Heap::init, Heap::initfromslice, and LockedHeap::new. It also affects multiple uses of the Heap::extend method. Initializati...

GHSA-XG8P-34W2-J49J linked_list_allocator vulnerable to out-of-bound writes on `Heap` initialization and `Heap::extend`

Impact What kind of vulnerability is it? Who is impacted? This vulnerability impacts all the initialization functions on the Heap and LockedHeap types, including Heap::new, Heap::init, Heap::initfromslice, and LockedHeap::new. It also affects multiple uses of the Heap::extend method. Initializati...

Use-After-Free

libexpat.so is vulnerable to use-after-free. The vulnerability is possible because the raw names will be pointing into the stored entity value instead of the parse buffer in doContent method of the file xmlparse.c, which doesn't release the consumed memory...

SuiteCRM authenticated SQL injection in export functionality

This module exploits an authenticated SQL injection in SuiteCRM in versions before 7.12.6. The vulnerability allows an authenticated attacker to send specially crafted requests to the export entry point of the application in order to retrieve all the usernames and their associated password from t...

PT-2022-25471 · Kdiskmark +1 · Kdiskmark +1

Name of the Vulnerable Software and Affected Versions: KDiskMark versions prior to 3.1.0 Description: The issue is related to a lack of authorization checking for D-Bus methods, specifically methods such as Helper::flushPageCache. This lack of authorization could potentially allow unauthorized...

CVE-2021-43138

A vulnerability was found in the async package. This flaw allows a malicious user to obtain privileges via the mapValues method...

CVE-2022-36101 Sensitive data in backend customer module

Shopware is an open source e-commerce software. In affected versions the request for the customer detail view in the backend administration contained sensitive data like the hashed password and the session ID. These fields are now explicitly unset in version 5.7.15. Users are advised to update an...

IBM DB2 安全漏洞

IBM DB2 is a relational database management system from International Business Machines IBM of the United States. The system is implemented in UNIX, Linux, IBMi, z/OS, and Windows server versions.A denial-of-service vulnerability exists in IBM DB2 versions 9.7, 10.1, 10.5, 11.1, and 11.5. An...

CVE-2022-36862

A heap-based overflow vulnerability in HWR::EngineCJK::Impl::Construct in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault...

xml-security: XPath Transform abuse allows for information disclosure

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any...

SAMSUNG Mobile devices 缓冲区错误漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from South Korea's Samsung SAMSUNG. A buffer error vulnerability exists in the SMR Sep-2022 Release 1 version of SAMSUNG Mobile devices, which stems from a heap-based overflow vulnerability in the...

Command injection

PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as...

CVE-2022-33941

PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as...

CVE-2022-25897

The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service DoS when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False...

Unbounded loop in BaseV1-core.sol could lead to a griefing/DOS attack

Lines of code Vulnerability details Denial Of Service Attack Denial-of-service attacks: Attacks that cause DoS are called DoS attacks. The purpose is to disable the computer or network from providing normal service. Description: As this array can grow quite large, the transaction’s gas cost could...