Mozilla: Cross-Origin resource's length leaked

The Mozilla Foundation Security Advisory describes this flaw as: A malicious website that could have learned the size of a cross-origin resource that supported Range requests...

Information Disclosure

firefox is vulnerable to information disclosure. The vulnerability exists because a malicious website could have learned the size of a cross-origin resource that supported Range requests which allows an attacker to get access to sensitive information...

CVE-2022-31736

A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects Thunderbird 91.10, Firefox 101, and Firefox ESR 91.10...

UBUNTU-CVE-2022-31736

A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects Thunderbird 91.10, Firefox 101, and Firefox ESR 91.10...

CVE-2022-31005 Integer Overflow in Vapor's HTTP Range Request

Vapor is an HTTP web framework for Swift. Users of Vapor prior to version 4.60.3 with FileMiddleware enabled are vulnerable to an integer overflow vulnerability that can crash the application. Version 4.60.3 contains a patch for this issue. As a workaround, disable FileMiddleware and serve via a...

flipper-server (>=0.171.1, <=0.212.0), flipper-server-companion (>=0.171.0, <=0.212.0) +1 more potentially affected by unknown CVE via flipper-frontend-core (>=0.171.0, <=0.212.0)

flipper-frontend-core NPM version =0.171.0, =0.171.1, =0.171.0, =0.171.1, =0.212.0 Source cves: unknown CVE Source advisory: OSV:MAL-2022-3074...

Chat Server 输入验证错误漏洞

Chat Server is ramank775 individual developer's chat server based on microservices architecture, supporting high availability, high throughput, and horizontal scaling. An input validation error vulnerability exists in Chat Server versions 2.3.2 through 2.6.0, which stems from the application havi...

PT-2022-20452 · Vapor · Vapor

Name of the Vulnerable Software and Affected Versions: Vapor versions prior to 4.60.3 Description: Vapor is an HTTP web framework for Swift. Users with FileMiddleware enabled are vulnerable to an integer overflow vulnerability that can crash the application. This issue can be triggered by invalid...

@agconnect/database (>=1.1.0, <=1.3.2), @ardenthq/sdk-egld (>=1.0.0, <=1.3.1) +124 more potentially affected by CVE-2022-25878 via protobufjs (>=6.10.0, <=6.10.2)

protobufjs NPM version =6.10.0, =1.1.0, =1.0.0, =3.0.0-next.36, =3.0.0-next.36, =3.0.0-next.36, =3.0.0-next.36, =0.0.0, =0.0.0-beta.20200917165907, =0.0.0-beta.20200724145337, =0.0.0-beta.20200724123546, =0.0.0-beta.20200724123546, =0.0.0-beta.20210111150545 and more Source cves: CVE-2022-25878...

GHSA-G954-5HWP-PP24 Prototype Pollution in protobufjs

The package protobufjs is vulnerable to Prototype Pollution, which can allow an attacker to add/modify properties of the Object.prototype. Versions after and including 6.10.0 until 6.10.3 and after and including 6.11.0 until 6.11.3 are vulnerable. This vulnerability can occur in multiple ways: 1...

EulerOS 2.0 SP3 : vim (EulerOS-SA-2022-1769)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - vim is vulnerable to Heap-based Buffer Overflow CVE-2021-3984, CVE-2021-4019, CVE-2022-0213 - vim is vulnerable to Use After Free CVE-2021-4069,...

Interpol Arrests Leader of SilverTerrier Cybercrime Gang Behind BEC Attacks

A year-long international investigation has resulted in the arrest of the suspected head of the SilverTerrier cybercrime group by the Nigeria Police Force. "The suspect is alleged to have run a transnational cybercrime syndicate that launched mass phishing campaigns and business email compromise...

Segfault if `tf.histogram_fixed_width` is called with NaN values in TensorFlow

Impact The implementation of tf.histogramfixedwidth is vulnerable to a crash when the values array contain NaN elements: python import tensorflow as tf import numpy as np tf.histogramfixedwidthvalues=np.nan, valuerange=1,2 The implementation assumes that all floating point operations are defined...

GHSA-XX36-6RV4-GJ8R ecdsa-elixir fails to check signatures, vulnerable to message forging

Summary Stark Bank is a financial technology company that provides services to simplify and automate digital banking, by providing APIs to perform operations such as payments and transfers. In addition, Stark Bank maintains a number of cryptographic libraries to perform cryptographic signing and...

GHSA-Q394-H7F5-7F44 Generation of Error Message Containing Sensitive Information in Elasticsearch

A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data...

MediaWiki Incorrect Access Control vulnerability

An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks $wgBlockCIDRLimit by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6...

GHSA-7MQG-5FGH-XH4R MediaWiki Incorrect Access Control vulnerability

An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks $wgBlockCIDRLimit by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6...

Google Chrome 权限许可和访问控制问题漏洞

Google Chrome is a web browser from Google, Inc. A privilege permission and access control issue vulnerability exists in Google Chrome versions 70.0.3538.67 through 101.0.4951.67, which stems from insufficient policy enforcement in the Extensions API. A remote attacker could exploit the...

CVE-2018-9058

In Long Range Zip aka lrzip 0.631, there is an infinite loop in the runzipfd function of runzip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted lrz file...

CVE-2018-10685

In Long Range Zip aka lrzip 0.631, there is a use-after-free in the lzmadecompressbuf function of stream.c, which allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact...