CVE-2022-36850

Path traversal vulnerability in CallBGProvider prior to SMR Sep-2022 Release 1 allows attacker to overwrite arbitrary file with phone uid...

PT-2022-23654 · Unknown · Callbgprovider

Name of the Vulnerable Software and Affected Versions: CallBGProvider versions prior to SMR Sep-2022 Release 1 Description: A path traversal issue allows an attacker to overwrite arbitrary files with the phone's user ID. Recommendations: For versions prior to SMR Sep-2022 Release 1, update to the...

CVE-2022-31167

XWiki Platform Security Parent POM contains the security APIs for XWiki Platform, a generic wiki platform. Starting with version 5.0 and prior to 12.10.11, 13.10.1, and 13.4.6, a bug in the security cache stores rules associated to document Page1.Page2 and space Page1.Page2 in the same cache entr...

Design/Logic Flaw

XWiki Platform Security Parent POM contains the security APIs for XWiki Platform, a generic wiki platform. Starting with version 5.0 and prior to 12.10.11, 13.10.1, and 13.4.6, a bug in the security cache stores rules associated to document Page1.Page2 and space Page1.Page2 in the same cache entr...

CVE-2022-31167

CVE-2022-31167 – XWiki Platform Security Parent POM Effective in XWiki Platform Security Parent POM prior to versions 12.10.11, 13.10.1, and 13.4.6, a bug in the security cache stores rules for document Page1.Page2 and space Page1.Page2 in the same cache entry. This can allow overwriting the righ...

CVE-2022-31167 XWiki Platform Security Parent POM vulnerable to overwriting of security rules of a page with a final page having the same reference

XWiki Platform Security Parent POM contains the security APIs for XWiki Platform, a generic wiki platform. Starting with version 5.0 and prior to 12.10.11, 13.10.1, and 13.4.6, a bug in the security cache stores rules associated to document Page1.Page2 and space Page1.Page2 in the same cache entr...

CVE-2022-31167 XWiki Platform Security Parent POM vulnerable to overwriting of security rules of a page with a final page having the same reference

XWiki Platform Security Parent POM contains the security APIs for XWiki Platform, a generic wiki platform. Starting with version 5.0 and prior to 12.10.11, 13.10.1, and 13.4.6, a bug in the security cache stores rules associated to document Page1.Page2 and space Page1.Page2 in the same cache entr...

Amazon Linux 2022 : php, php-bcmath, php-cli (ALAS2022-2022-085)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-085 advisory. A flaw was found in PHP. The vulnerability occurs due to the malformed phpfilterfloat function and leads to a use-after-free vulnerability. This flaw allows an attacker to inject a malicious file, leadi...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.16.1)

The version of AOS installed on the remote host is prior to 5.16.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.16.1 advisory. - OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this...

Google Chrome Bug Lets Sites Silently Overwrite System Clipboard Content

A "major" security issue in the Google Chrome web browser, as well as Chromium-based alternatives, could allow malicious web pages to automatically overwrite clipboard content without requiring any user consent or interaction by simply visiting them. The clipboard poisoning attack is said to have...

OESA-2022-1875 rsync security update

Rsync is an open source utility that provides fast incremental file transfer.It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files ar...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.11.3)

The version of AOS installed on the remote host is prior to 5.11.3. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.11.3 advisory. - A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver...

SUSE SLED15: gstreamer-plugins-good / gstreamer-plugins-good-32bit / etc (SUSE-SU-2022:2957-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2957-1 advisory. - CVE-2022-1920: Fixed integer overflow in WavPack header handling code bsc1201688. -...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.16.0.1)

The version of AOS installed on the remote host is prior to 5.16.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.16.0.1 advisory. - OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of...

Input validation

An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation...

CVE-2022-36562

Incorrect access control in the install directory C:\Ruby31-x64 of Rubyinstaller2 v3.1.2 and below allows authenticated attackers to execute arbitrary code via overwriting binaries located in the directory...

CVE-2022-37172

Incorrect access control in the install directory C:\msys64 of Msys2 v20220603 and below allows authenticated attackers to execute arbitrary code via overwriting binaries located in the directory...

CVE-2022-36565

Incorrect access control in the install directory C:\Wamp64 of Wamp v3.2.6 and below allows authenticated attackers to execute arbitrary code via overwriting binaries located in the directory...

Fuji Electric D300win 缓冲区错误漏洞

The Fuji Electric D300win is a PLC product and solution from Fuji Electric Japan. A security vulnerability exists in the Fuji Electric D300win that stems from vulnerability to a write-what-where condition, which can be exploited by an attacker to overwrite program memory in order to manipulate th...

MSYS2 安全漏洞

MSYS2 is MSYS2 open source set of tools and libraries. It provides an easy-to-use environment for building, installing and running native Windows software. A security vulnerability exists in MSYS2 version v20220603 and earlier versions that originates from incorrect access control in the...