CVE-2022-23889

The CVE-2022-23889 entry concerns YzmCMS v6.3 where the comment function can be operated concurrently, enabling an attacker to generate an unusually large number of comments. The core issue is a race/concurrency condition in the comment handling code, leading to potential resource exhaustion or i...

CVE-2022-23889

The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments...

Unsafe ERC20 Operation(s)

Handle Czar102 Vulnerability details Impact ERC20 tokens may not revert on failure, instead return false. Users may lose their funds as ERC20 calls may fail. They are made to unknown ERC20 tokens that have no additional constraints on their failure reporting. Findings: LaunchEvent.sol::458 =...

Jsish boolean buffer overflow vulnerability

Jsish is a small JavaScript parser with a built-in database written in C. Jsish is vulnerable to a buffer overflow vulnerability that originates when a networked system or product performs an operation on memory without properly validating data boundaries, resulting in an incorrect read or write...

Jsish linenoise buffer overflow vulnerability

Jsish is a small JavaScript parser with a built-in database written in C. Jsish is vulnerable to a buffer overflow vulnerability that originates when a networked system or product performs an operation on memory without properly validating data boundaries, resulting in an incorrect read or write...

WordPress Qubely plugin cross-site request forgery vulnerability

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. cross-site request forgery vulnerability exists in versions prior to 1.7.8 of the Qubely plugin for WordPress, which...

CVE-2022-23033

arm: guestphysmapremovepage not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm p2mremovemapping, guestphysmapremovepage, and p2msetentry with mfn set to INVALIDMFN do not actually clear the pagetable entry if the entry doesn't have the vali...

CVE-2022-23035

Insufficient cleanup of passed-through device IRQs The management of IRQs associated with physical devices exposed to x86 HVM guests involves an iterative operation in particular when cleaning up after the guest's use of the device. In the case where an interrupt is not quiescent yet at the time...

Heap-based Buffer Overflow in vim/vim

Description Heap-buffer-overflow on write in vim This issue was created to separate this one and was fixed with Patch 8.2.4218. Proof of Concept Steps to reproduce: echo -n bm9ybTBRgFBTMP8wMDCysDAwMDAwMDAwMDAwMDAw/zD/g7IwMDAwMDAwMDAwjjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAD | base64 -d heapowpoc2 vim ...

CVE-2021-23236

Requests may be used to interrupt the normal operation of the device. When exploited, Fresenius Kabi Agilia Link+ version 3.0 must be rebooted via a hard reset triggered by pressing a button on the rack system...

CVE-2021-23236 Fresenius Kabi Agilia Connect Infusion System uncontrolled resource consumption

Requests may be used to interrupt the normal operation of the device. When exploited, Fresenius Kabi Agilia Link+ version 3.0 must be rebooted via a hard reset triggered by pressing a button on the rack system...

The vulnerability of the g_file_replace() function in the Glib library, which allows operation under a non-root account, enables an attacker to compromise data integrity.

The vulnerability of the gfilereplace function in the Glib library is related to the ability to operate under a user account without root privileges. Exploiting this vulnerability could allow an attacker to compromise data integrity...

CVE-2021-46025

A Cross SIte Scripting XSS vulnerability exists in OneBlog = 2.2.8. via the add function in the operation tab list in the background...

Cross site scripting

A Cross SIte Scripting XSS vulnerability exists in OneBlog = 2.2.8. via the add function in the operation tab list in the background...

CVE-2021-46025

The CVE-2021-46025 entry describes a Cross-Site Scripting (XSS) vulnerability in OneBlog

KB5010794: Out-of-band update for Windows 8.1 and Windows Server 2012 R2: January 17, 2022

KB5010794: Out-of-band update for Windows 8.1 and Windows Server 2012 R2: January 17, 2022 Summary This update resolves the following issues: Virtual machines VMs located on a server that has Unified Extensible Firmware Interface UEFI enabled fail to start after installing the January 11, 2022...

[SECURITY] Fedora 35 Update: python-celery-5.2.3-2.fc35

An open source asynchronous task queue/job queue based on distributed message passing. It is focused on real-time operation, but supports scheduling as well. The execution units, called tasks, are executed concurrently on one or more worker nodes using multiprocessing, Eventlet or gevent. Tasks c...

‘Be Afraid:’ Massive Cyberattack Downs Ukrainian Gov’t Sites

Cyberattackers brought down around 70 Ukrainian government websites on Friday, defacing the site of the foreign ministry with a message to “Be afraid and expect the worst.” The huge attack hit on Friday, unfolding hours after Russia and Western allies wrapped up fruitless talks intended to...

Binaryen Stack Buffer Overflow Vulnerability

Binaryen is a compiler infrastructure and toolchain library for WebAssembly written in C++. Binaryen has a stack buffer overflow vulnerability in version 103, which originates when the software printf public function performs an operation in memory, and can be exploited by an attacker to cause...

WordPress RegistrationMagic plugin SQL injection vulnerability

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blogging sites on servers with PHP and MySQL.The WordPress RegistrationMagic plugin was vulnerable to SQL injection before 5.0.1.6, which stems from the la...