InnoSetup 代码问题漏洞

InnoSetup is a free installer for Windows programs provided by Jordan Russell and Martijn Laan of jrsoftware. A security vulnerability exists in InnoSetup that originates from an uncontrolled search path in the application's installer...

Conducting Modern Insider Risk Investigations

Dealing with risks presented by internal users requires a different approach than those from external threats. This shouldn’t be news to anyone, but it does need to be said since it’s not something that always happens in practice. It’s not uncommon to see the cudgels common to blue teams wielded...

XXL-JOB Cross-Site Scripting Vulnerability (CNVD-2022-66673)

XXL-JOB is a java-based distributed task scheduling platform from the XXL XXL-JOB community. xxl-job version 2.3.0 is vulnerable to a cross-site scripting vulnerability. An attacker can exploit this vulnerability to execute JavaScript programs...

DEBIAN-CVE-2022-31782

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow...

CVE-2022-31782

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow...

Heap overflow

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow...

CVE-2022-31782

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow...

UBUNTU-CVE-2022-31782

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow...

FreeType 缓冲区错误漏洞

FreeType is an open source font rendering library written in the C language. A security vulnerability exists in ftbench.c in FreeType Demo Programs version 2.12.1 and earlier versions, which can be exploited by an attacker to cause a heap-based buffer overflow...

Remote code execution

A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs,...

CVE-2022-24848: Improper Neutralization of Special Elements used in an SQL Command

DHIS2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability affects the /api/programs/orgUnits?programs= API endpoint in DHIS2 versions prior to 2.36.10.1 and 2.37.6.1. The system is vulnerable to attack only from...

CVE-2022-30190

A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs,...

CVE-2022-31782

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow...

CVE-2022-31782

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow...

CVE-2022-31782

CVE-2022-31782 affects ftbench.c in FreeType Demo Programs up to version 2.12.1, causing a heap-based buffer overflow. The connected advisories enumerate this CVE in EulerOS/Astra Linux contexts, but no exploit details or patch/version information is provided in the documents.

CVE-2022-31782

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow...

CVE-2022-31782: Out-of-bounds Write

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow...

The Verizon 2022 DBIR

The Verizon 2022 Data Breach Investigations Report is out. We are proud to collaborate as a supporting contributor to this years data efforts once again and to have contributed for the past 8 years. The report provides interesting analysis of a full amount of global incident data. Several things...

GO-2022-0166 Denial of service due to unchecked parameters in crypto/dsa

The Verify function in crypto/dsa passed certain parameters unchecked to the underlying big integer library, possibly leading to extremely long-running computations, which in turn makes Go programs vulnerable to remote denial of service attacks. Programs using HTTPS client certificates or the Go...

Get to Know Patrick Flynn

Meet Patrick Flynn Head of Advanced Programs Group at Trellix Threat Labs By Trellix · May 24, 2022 This blog was written by Michael Alicea At Trellix, we celebrate and champion our people. This week, I sat down with Pat Flynn, Head of Advanced Programs Group for Trellix Threat Labs. His job is a...