tomcat: Request mix-up with h2c

A flaw was found in Apache Tomcat. When responding to new h2c connection requests, Apache Tomcat could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request. The highest threat from this...

IOBit Advanced System Care (Asc.exe) 15、Action Download Center 安全漏洞

IOBit Advanced System Care Free and IOBit Action Download Center are both products of the British company IOBit.IOBit Advanced System Care Free is a system management utility. The program is mainly used for scanning, repairing and optimizing the system, etc.IOBit Action Download Center is a...

AZL-41814 CVE-2022-2097 affecting package hvloader for versions less than 1.0.1-2

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption...

UBUNTU-CVE-2022-34480

Within the lginit function, if several allocations succeed but then one fails, an uninitialized pointer would have been freed despite never being allocated. This vulnerability affects Firefox 102...

The vulnerability of the Cboot module (tegrabl_cbo.c) in the NVIDIA Jetson microprogramming system driver package allows a hacker to execute arbitrary code or cause a partial service failure.

The vulnerability of the Cboot module tegrablcbo.c in the NVIDIA Jetson microprogramming system driver package is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to execute arbitrary code or cause partial service failure...

The vulnerability of the ext4_mount function in the Cboot module of the NVIDIA Jetson embedded software driver package allows a attacker to execute arbitrary code, gain elevated privileges, or cause partial service failure.

The vulnerability of the ext4mount function in the Cboot module of the NVIDIA Jetson software driver suite is related to a numerical overflow issue. Exploiting this vulnerability could allow an attacker to execute arbitrary code, gain elevated privileges, or cause partial service interruptions...

The vulnerability of the blob_decompress function in the Cboot module of the NVIDIA Jetson embedded software driver package allows a attacker to execute arbitrary code or cause a partial service failure.

The vulnerability of the blobdecompress function in the Cboot module of the NVIDIA Jetson embedded software driver package is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to execute arbitrary code or cause partial service failure...

The vulnerability of the Infrastructure component of the Oracle FLEXCUBE Universal Banking system allows a perpetrator to gain access to data reading or cause a partial service disruption.

The vulnerability of the Infrastructure component of the Oracle FLEXCUBE Universal Banking system exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain read access to data or cause partial service interruption...

The vulnerability of the Cboot module (tegrabl_cbo.c) in the NVIDIA Jetson microprogramming system driver package allows a hacker to execute arbitrary code or cause a partial service failure.

The vulnerability of the Cboot module tegrablcbo.c in the NVIDIA Jetson microprogramming system driver package is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code or cause a partial service failure...

Stripo Inc: Non-revoked API Key Information disclosure via Stripo_report()

Talking about 983331 reports where a security researcher reported secret API key leakage vulnerability in a JavaScript file at Stripo. This report is disclosed on HackerOne, and the team at Stripo have forgotten to blur the API keys from the report before disclosing it to the public. The API keys...

CVE-2022-31802

In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. An attacker may perform authentication by specifying a small password that matches the corresponding part of the longer real CODESYS Gatewa...

CODESYS Gateway Server 安全漏洞

CODESYS Gateway Server is an extended CODESYS Gateway from CODESYS Corporation that connects a CODESYS Automation Server to a CODESYS PLC in a local network. A security vulnerability exists in versions prior to CODESYS Gateway Server V2 V2.3.9.38 that stems from comparing only a portion of a...

CVE-2022-26668 ASUS Control Center - Broken Access Control

ASUS Control Center API has a broken access control vulnerability. An unauthenticated remote attacker can call privileged API functions to perform partial system operations or cause partial disrupt of service...

CVE-2018-18907

An issue was discovered on D-Link DIR-850L 1.21WW devices. A partially completed WPA handshake is sufficient for obtaining full access to the wireless network. A client can access the network by sending packets on Data Frames to the AP without encryption...

Broker: Malformed message can result in partial DoS (OOM)

A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory OOM condition. This flaw allows an attacker to partially disrupt availability to the broker through a sustained attack of maliciously crafted messages. The highest...

Intel: CVE-2022-21166 Device Register Partial Write (DRPW)

...

CVE-2022-31802

In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. An attacker may perform authentication by specifying a small password that matches the corresponding part of the longer real CODESYS Gatewa...

OpenJDK: Missing check for negative ObjectIdentifier (Libraries, 8275151)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Difficult to exploit...

OpenJDK: Excessive memory allocation in HashMap and HashSet (Utility, 8266097)

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Utility. Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated...

OpenJDK: Infinite loop related to incorrect handling of newlines in XMLEntityScanner (JAXP, 8270646)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JAXP. Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows...