[SECURITY] Fedora 37 Update: plasma-systemmonitor-5.27.1-1.fc37

An interface for monitoring system sensors, process information and other sys tem resources...

OpenImageIO Heap Out-of-Bounds Read Vulnerability (CNVD-2023-01796)

OpenImageIO is an image read and write library that also provides several tools and applications. OpenImageIO v2.3.19.0 suffers from a heap out-of-bounds read vulnerability when processing IPTC data. An attacker could exploit this vulnerability to read heap memory via specially crafted TIFF files...

CVE-2022-41649

A heap out of bounds read vulnerability exists in the handling of IPTC data while parsing TIFF images in OpenImageIO v2.3.19.0. A specially-crafted TIFF file can cause a read of adjacent heap memory, which can leak sensitive process information. An attacker can provide a malicious file to trigger...

Siemens Parasolid 缓冲区错误漏洞

Parasolid is a 3D geometric modeling tool that supports a variety of techniques, including solid modeling, direct editing, and free-form/sheet modeling.Simcenter Femap is an advanced simulation application for creating, editing, and examining finite element models of complex products or...

PT-2024-11519 · Freebsd · Freebsd

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue arises when dumping core and saving process information, as proc getargv might return an sbuf with an sbuf len of 0 or -1, which is not proper...

FreeBSD -- Out of bound read in elf_note_prpsinfo()

Problem Description: When dumping core and saving process information, procgetargv might return an sbuf which have a sbuflen of 0 or -1, which is not properly handled. Impact: An out-of-bound read can happen when user constructs a specially crafted psstring, which in turn can cause the kernel to...

Siemens PADS Standard/Plus Viewer 缓冲区错误漏洞

PADS Standard and Standard Plus provide PCB schematic design and layout functionality in an intuitive and easy-to-use environment.An out-of-bounds read vulnerability exists in Siemens PADS Standard/Plus Viewer, which could be exploited by an attacker to disclose information in the context of the...

CVE-2021-32957

A function in MDT AutoSave versions prior to v6.02.06 is used to retrieve system information for a specific process, and this information collection executes multiple commands and summarizes the information into an XML. This function and subsequent process gives full path to the executable and is...

CVE-2021-22782

Missing Encryption of Sensitive Data vulnerability exists in EcoStruxure Control Expert all versions prior to V15.0 SP1, including all versions of Unity Pro, EcoStruxure Process Expert all versions, including all versions of EcoStruxure Hybrid DCS, and SCADAPack RemoteConnect for x70, all version...

Information disclosure

Missing Encryption of Sensitive Data vulnerability exists in EcoStruxure Control Expert all versions prior to V15.0 SP1, including all versions of Unity Pro, EcoStruxure Process Expert all versions, including all versions of EcoStruxure Hybrid DCS, and SCADAPack RemoteConnect for x70, all version...

CVE-2021-22782

Missing Encryption of Sensitive Data vulnerability exists in EcoStruxure Control Expert all versions prior to V15.0 SP1, including all versions of Unity Pro, EcoStruxure Process Expert all versions, including all versions of EcoStruxure Hybrid DCS, and SCADAPack RemoteConnect for x70, all version...

CVE-2021-22782

CVE-2021-22782 is a Missing Encryption of Sensitive Data vulnerability affecting Schneider Electric products, including EcoStruxure Control Expert (Unity Pro), EcoStruxure Process Expert, and SCADAPack RemoteConnect for x70. The issue allows information disclosure of network/process data, credent...

MDT AutoSave SQL注入漏洞

MDT AutoSave is a software application. It provides an automated change management function. An SQL injection vulnerability exists in MDT AutoSave where a function in the device is used to retrieve process-specific system information, which is collected by executing multiple commands and...

Remote Code Execution (RCE)

apachesuperset is vulnerable to remote code execution RCE. Failure to validate a number of templated text fields allows an authenticated user to send malicious requests and gain access to Pythons os package in the web application process and access files, environment variables and process...

PYSEC-2020-222

While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests via a number of templated text fields in the product that would allow arbitrary access to Python’s os package in the web application process in versions 0.37.1. It was thus...

PT-2020-13798 · Apache · Apache Superset

Name of the Vulnerable Software and Affected Versions: Apache Superset versions prior to 0.37.1 Description: The issue allows an authenticated user to gain arbitrary access to Python's os package in the web application process. This enables the user to list and access files, environment variables...

OSIsoft PI System Cross-Site Scripting Vulnerability

OSIsoft PI Web API is a product from OSIsoft USA for accessing PI system data. A cross-site scripting vulnerability exists in the OSIsoft PI System, which can be exploited by an attacker to disclose, delete, or modify information without authorization...

CVE-2017-13852

An issue was discovered in certain Apple products. iOS before 11.1 is affected. macOS before 10.13.1 is affected. tvOS before 11.1 is affected. watchOS before 4.1 is affected. The issue involves the "Kernel" component. It allows attackers to monitor arbitrary apps via a crafted app that accesses...

CVE-2017-13852

An issue was discovered in certain Apple products. iOS before 11.1 is affected. macOS before 10.13.1 is affected. tvOS before 11.1 is affected. watchOS before 4.1 is affected. The issue involves the "Kernel" component. It allows attackers to monitor arbitrary apps via a crafted app that accesses...

libXdmcp: weak entropy usage for session keys

It was discovered that libXdmcp used weak entropy to generate session keys. On a multi-user system using xdmcp, a local attacker could potentially use information available from the process list to brute force the key, allowing them to hijack other users' sessions...