4415 matches found
PT-2022-18404 · Red Hat · Podman
Name of the Vulnerable Software and Affected Versions: podman versions prior to the version fixed via RHSA-2020:2117 Description: The issue could potentially be used to crash or cause code execution in Go applications using the Go GPGME wrapper library under certain conditions during GPG signatur...
CVE-2020-35525
In SQlite 3.31.1, a potential null pointer derreference was found in the INTERSEC query processing...
Cross site scripting
Potential vulnerabilities have been identified in Micro Focus ArcSight Logger. The vulnerabilities could be remotely exploited resulting in Information Disclosure, or Self Cross-Site Scripting XSS. This issue affects: Micro Focus ArcSight Logger versions prior to v7.2.2 version and prior versions...
No rate limit via proxy url parameter
Description Hi Drawio Team , Your proxy server has no limit of requests which an attacker can use it as PORT SCANNER. https://app.diagrams.net/proxy?url=IP:PORT&base64=1 Proof of Concept Image from my OWASP ZAP : https://ibb.co/h87hz3N...
FreeBSD : zeek -- potential DoS vulnerabilities (3110b29e-c82d-4287-9f6c-db82bb883b1e)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 3110b29e-c82d-4287-9f6c-db82bb883b1e advisory. - Tim Wojtulewicz of Corelight reports: Fix a possible overflow and crash in the ARP analyzer when...
PT-2022-23402 · Totolink · Totolink N350Rt
Name of the Vulnerable Software and Affected Versions: TOTOLINK N350RT version 9.3.5u.6139 B20201216 Description: A stack overflow issue was discovered via the command parameter in the setTracerouteCfg function. This allows for potential exploitation. Recommendations: For TOTOLINK N350RT version...
Reddit users crowdsourcing explicit images and identities
The BBC is warned of a large photograph trading ring which operated on popular group forum site Reddit. These warnings are in relation to stolen nude photographs and other content shared without permission. In this case, even non-explicit photos are being posted alongside frequently degrading and...
Malicious code in odecache (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad2492c47772e6e4cf129300e624b27336ee956fab51b575916ea1a28fe771d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in j8i (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a8e50d0c388cadd79c244f783d14a491979a6559ee11cde9d6d3de45d706c60f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @scoober/foodtracker (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 78ab9e13225d5458ba5938b1b9a9f9691a09bcc5294e47d46405286c2449f750 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-2837
A flaw was found in coreDNS. This flaw allows a malicious user to redirect traffic intended for external top-level domains TLD to a pod they control by creating projects and namespaces that match the TLD. Mitigation - Add a default admission controller to prevent the creation of projects or...
CVE-2022-36010 Arbitrary code execution via function parsing in react-editable-json-tree
This library allows strings to be parsed as functions and stored as a specialized component, JsonFunctionValue. To do this, Javascript's eval function is used to execute strings that begin with "function" as Javascript. This unfortunately could allow arbitrary code to be executed if it exists as ...
Memory corruption
The thread function doesn’t free a variable t-thbuf.gnulongname after allocating memory, which may cause a memory leak...
Directory traversal
Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack...
HP PC BIOS August 2022 Security Updates for Potential SMM and TOCTOU Vulnerabilities
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate these potential vulnerabilities. HP has...
Intel 2022.2 IPU BIOS Security Updates
Intel has informed HP of a potential security vulnerability in some Intel® Processors, which might allow information disclosure. Intel is releasing firmware updates to mitigate this potential vulnerability. Intel has released updates to mitigate the potential vulnerability. HP has identified...
Intel® IPP Cryptography Advisory
Summary: A potential security vulnerability in an Intel® Integrated Performance Primitives IPP Cryptography software library may allow information disclosure. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2022-26083 Description:...
SUSE-SU-2022:2642-1 Security update for xscreensaver
This update for xscreensaver fixes the following issues: - CVE-2021-34557: Fixed potential crash and unlock while disconnecting video output with more than 10 monitors bsc1186918...
Mozilla: Memory safety bugs fixed in Firefox 103 and 102.1
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Mozilla developers and the Mozilla Fuzzing Team reporting memory safety bugs in Firefox 102. Some of these bugs showed evidence of memory corruption, and we presume that with enough effort, some of these...
