Libraries GraalVM Enterprise Modification

The vulnerability of the Libraries component in the Oracle GraalVM Enterprise Edition virtual machine exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to modify, add, or delete data using network packet...

QNAP Systems 多款产品跨站脚本漏洞

QNAP Systems QUTS Hero and QNAP QuTScloud are both products of China Weilian QNAP Systems.QUTS Hero is a NAS operating system for file management. The system retains the application ecosystem of QTS and integrates the more powerful 128-bit ZFS file system to provide enterprises with a more stable...

Blink Web Page Disclosure

The vulnerability of the Blink web page display mechanism in Microsoft Edge and Google Chrome exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

Vulnerabilities fixed in cURL

Vulnerabilities have been fixed in cURL. The vulnerabilities allow a remote malicious party potentially able to obtain sensitive data obtain or to bypass authentication. The developers of cURL have released updates to fix the vulnerabilities. More information can be found on the pages below:...

OpenJDK: Improper object-to-string conversion in AnnotationInvocationHandler (Libraries, 8277672)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable...

OpenJDK: Improper object-to-string conversion in AnnotationInvocationHandler (Libraries, 8277672)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable...

OpenJDK: URI parsing inconsistencies (JNDI, 8278972)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JNDI. Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable...

Oracle Communications Convergence Data Access

The vulnerability of the Oracle Communications Convergence software component for network management and organization applications exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to remotely gain access to modify, add, or delete dat...

Oracle Communications Operations Monitor Mediation Engine Privilege Escalation

The vulnerability of the Mediation Engine component of the Oracle Communications Operations Monitor visualization and monitoring system exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to read, modify, add...

VLC Media Player AVI_ExtractSubtitle Confidential Data DoS

The vulnerability of the AVIExtractSubtitle component in the VLC Media Player media player is related to the copying of buffers without checking the input data. Exploiting this vulnerability allows a remote attacker to gain access to confidential data and also cause a service failure by using a...

Puppet CSV Injection Confidential Data DoS

The vulnerability of the Puppet infrastructure automation tool relates to the absence of a mechanism for neutralizing elements in the CSV file. Exploiting this vulnerability allows a remote attacker to gain access to confidential data, compromise its integrity, and cause service interruptions...

GPAC Decoder Confidential Data Compromise

The vulnerability of the SVHD decoder, a component of the MPEG-4 multimedia platform GPAC, lies in the lack of verification for the result of the addition arithmetic operation. Exploiting this vulnerability allows an attacker operating remotely to gain access to confidential data, compromise its...

SIX functional decoding system MPEG-4 Multimedia Platform DoS

The vulnerability of the SSIX decoder for MPEG-4 multimedia platform GPAC is related to incorrect checking of the result of an arithmetic operation. Exploiting this vulnerability allows a remote attacker to gain access to confidential data, compromise its integrity, and cause service failures...

PT-2022-18952 · Bentley · Microstation Connect

Name of the Vulnerable Software and Affected Versions: Bentley MicroStation CONNECT version 10.16.02.034 Description: This issue allows remote attackers to disclose sensitive information on affected installations. User interaction is required, where the target must visit a malicious page or open ...

IBM System Storage DS8000 Hardware Management Console 安全漏洞

The IBM System Storage DS8000 Hardware Management Console IBM System Storage DS8000 HMC is a hardware management console for the IBM Storage Media Platform DS8000 from IBM in the United States. A security vulnerability exists in IBM System Storage DS8000 Management Console HMC R8.5 88.5x.x.x, R9....

Mbed TLS SSL/TLS Certificate Validation

The vulnerability of TLS and SSL Mbed TLS implementations is related to the incorrect comparison of NULL with an empty array. Exploiting this vulnerability allows a remote attacker to compromise data integrity...

Mbed TLS SSL/TLS Certificate Validation

The vulnerability of TLS and SSL Mbed TLS implementations is related to the incorrect use of the revocationDate check. Exploiting this vulnerability allows a remote attacker to compromise the integrity of data...

Mbed TLS Information Disclosure

The vulnerability of TLS and SSL Mbed TLS implementations lies in the dependence of the instruction’s execution time on the data of that instruction. Exploiting this vulnerability allows a remote attacker to gain access to confidential data...

GitLab Query Data Compromise

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the insufficient neutralization of certain elements in the request. Exploiting this vulnerability allows a malicious actor to compromise data integrity remotely...

lwIP ICMP6 Buffer Overflow Confidential Data

The vulnerability of the icmp6sendresponsewithaddrsandnetif function in the TCP/IP protocol implementation of the lwIP stack is related to the copying of buffers without checking the input data. Exploiting this vulnerability allows a remote attacker to gain access to confidential data through a...