PT-2022-6364 · Dell · Dell Bios

Name of the Vulnerable Software and Affected Versions: Dell BIOS affected versions not specified Description: The issue is related to the use of an uninitialized variable in the BIOS software of Dell laptops. This could potentially allow a malicious user to execute arbitrary code. A local...

Insyde InsydeH2O 输入验证错误漏洞

Insyde InsydeH2O is a C source from Insyde Corporation of Taiwan, which implements the new technology "EFI/UEFI" specification designed to replace the traditional BIOS Basic Input/Output System. An input validation error vulnerability exists in Insyde InsydeH2O. An attacker can exploit this...

CVE-2021-4213

A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service...

Fedora: Security Advisory for golang-github-oneofone-xxhash (FEDORA-2022-37aef44d1e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Citrix Hypervisor Security Bulletin for CVE-2022-23825 and CVE-2022-29900

AMD has disclosed an issue that affects AMD CPU hardware and may allow code inside a guest VM to infer the contents of RAM memory elsewhere on the host. Although this is not an issue in the Citrix Hypervisor product itself, Citrix is releasing hotfixes that include product changes to mitigate thi...

PT-2025-26016

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the Linux kernel, specifically with the btrfs filesystem. On zoned filesystems, data write out is limited by max zone append size, and a large ordered extent is...

Fedora: Security Advisory for squid (FEDORA-2022-0fa51087e7)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Mattermost: DOS: out of memory from gif through upload api

Summary: When sending a specially crafted gif with max dimensions through the upload API, we get Mattermost server to consume more than 4Gbytes of RAM Steps To Reproduce: add details for how we can reproduce the issue 1. Run docker run --name mattermost-preview -d --publish 8065:8065...

GHSA-5CRP-9R3C-P9VR Improper Handling of Exceptional Conditions in Newtonsoft.Json

Newtonsoft.Json prior to version 13.0.1 is vulnerable to Insecure Defaults due to improper handling of expressions with high nesting level that lead to StackOverFlow exception or high CPU and RAM usage. Exploiting this vulnerability results in Denial Of Service DoS. The serialization and...

Information disclosure

In handleramdump of pixelloader.c, there is a possible way to create a ramdump of non-secure memory due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2022-20182

CVE-2022-20182 concerns the Android kernel component handle_ramdump inside pixel_loader.c. The vulnerability arises from a missing permission check, enabling creation of a ramdump of non-secure memory and potentially leading to local information disclosure with SYSTEM privileges required. Exploit...

Real Player v.20.0.8.310 G2 Control - DoGoToURL() Remote Code Execution Exploit

Exploit Title: Real Player v.20.0.8.310 G2 Control - 'DoGoToURL' Remote Code Execution RCE Exploit Author: Eduardo Braun Prado Vendor Homepage: http://real.com/ Software Link: http://real.com/ Version: v.20.0.8.310 Tested on: Windows 7, 8.1, 10 CVE : N/A Full PoC:...

Real Player v.20.0.8.310 G2 Control - 'DoGoToURL()' Remote Code Execution (RCE)

Exploit Title: Real Player v.20.0.8.310 G2 Control - 'DoGoToURL' Remote Code Execution RCE Google Dork: n/a Date: May 31, 2022 Exploit Author: Eduardo Braun Prado Vendor Homepage: http://real.com/ Software Link: http://real.com/ Version: v.20.0.8.310 Tested on: Windows 7, 8.1, 10 CVE : N/A Full...

CVE-2022-32291

In Real Player through 20.1.0.312, attackers can execute arbitrary code by placing a UNC share pathname for a DLL file in a RAM file...

CVE-2022-32291

In Real Player through 20.1.0.312, attackers can execute arbitrary code by placing a UNC share pathname for a DLL file in a RAM file...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference via qemuramfree. Remediation Upgrade unicorn to version 2.0.0 or higher. References - GitHub Commit - GitHub Commit - GitHub Commit - GitHub Issue - Write up Credit: liyansong2018...

CVE-2022-29694

Unicorn Engine v2.0.0-rc7 and below was discovered to contain a NULL pointer dereference via qemuramfree...

CVE-2022-28656

isclosingsession allows users to consume RAM in the Apport process...

AMD BIOS Denial of Service Vulnerability

AMD BIOS is the base input and output system for AMD. A denial of service vulnerability exists in AMD BIOS, which stems from improper validation of the BIOS directory. An attacker could exploit this vulnerability to read content outside of a copy of the directory table in RAM, resulting in a...

CVE-2022-26781

Multiple improper input validation vulnerabilities exists in the libnvram.so nvramimport functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted file can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability.An improper input...