CVE-2022-29017

Bento4 v1.6.0.0 was discovered to contain a segmentation fault via the component /x8664/multiarch/strlen-avx2.S...

CVE-2022-29017

Bento4 v1.6.0.0 was discovered to contain a segmentation fault via the component /x8664/multiarch/strlen-avx2.S...

Design/Logic Flaw

Bento4 v1.6.0.0 was discovered to contain a segmentation fault via the component /x8664/multiarch/strlen-avx2.S...

CVE-2022-29017

Bento4 v1.6.0.0 was discovered to contain a segmentation fault via the component /x8664/multiarch/strlen-avx2.S...

Bento4 安全漏洞

Bento4 is an open source C library for reading and writing MP4 files. Bento4 v1.6.0.0 contains a denial of service vulnerability that stems from a segmentation error in the /x8664/multiarch/strlen-avx2.S component, which could be exploited by an attacker to cause a denial of service...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I’m speaking on “Securing a World of Physically Capable Computers” at OWASP Belgium’s chapter meeting in Antwerp, Belgium, on May 17, 2022. I’m speaking at Future Summits in Antwerp, Belgium, on May 18, 2022. I’m speaking at IT-S N...

GHSA-XVHR-7Q4Q-QJGP thinkphp SQL Injection via the index.php s parameter

thinkphp 3.1.3 has SQL Injection via the index.php s parameter...

thinkphp SQL Injection via the index.php s parameter

thinkphp 3.1.3 has SQL Injection via the index.php s parameter...

CVE-2021-43529

A flaw was found in Thunderbird, which is vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. Thunderbird versions 91.3.0 and later will not call the vulnerable code when processing S/MIME messages that contain certificates with DER-encoded DSA or RSA-PSS...

CVE-2022-28077

Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting XSS vulnerability in the Admin panel via the $GET's' parameter...

Security Updates for Microsoft SharePoint Server Subscription Edition (May 2022)

The Microsoft SharePoint Server Subscription Edition installation on the remote host is missing security updates. It is, therefore, affected by a remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. %NASLMINLEVEL...

A special browser designed for online banking. Good idea, or not so much?

The German Sparkasse bank has launched a browser that is especially designed to do your online banking. The browser called S-Protect is available for macOS and Windows users. The idea is interesting, since having a separate browser for banking can certainly add an extra layer of security. Separat...

Fedora: Security Advisory for grafana (FEDORA-2022-c5383675d9)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

s-cart Cross-Site Scripting Vulnerability (CNVD-2022-70091)

s-cart is a Php-based e-commerce management platform from the s-cart community. s-cart versions prior to 6.9 contain a cross-site scripting vulnerability that can be exploited by attackers to execute JavaScript code on the client side, which can steal cookies from any victim who accesses the...

DEBIAN-CVE-2022-24884

ecdsautils is a tiny collection of programs used for ECDSA keygen, sign, verify. ecdsaverifypreparelegacy does not check whether the signature values r and s are non-zero. A signature consisting only of zeroes is always considered valid, making it trivial to forge signatures. Requiring multiple...

ECDSA Util 数据伪造问题漏洞

ECDSA Util is a collection of applets for ECDSA. A security vulnerability exists in ECDSA Util versions prior to 0.4.1, which stems from ecdsaverifypreparelegacy not checking that the signature values r and s are non-zero...

Cross-site Scripting (XSS)

s-cart/s-cart and s-cart/core are vulnerable to cross-site scriptingXSS attacks. An attacker is able to steal user cookies by tricking a victim to visit a specifically crafted URL and gain unauthorized access to that user's account...

Cisco Adaptive Security Appliance Software Software WebVPN Portal Access Rule Bypass (cisco-sa-asaftd-rule-bypass-P73ABNWQ)

According to its self-reported version, Cisco Adaptive Security Appliance Software is affected by a vulnerability. This vulnerability could allow an unauthenticated, remote attacker to bypass a configured access rule and access parts of the WebVPN portal that are supposed to be blocked. The...

CVE-2022-21149

The package s-cart/s-cart before 6.9; the package s-cart/core before 6.9 are vulnerable to Cross-site Scripting XSS which can lead to cookie stealing of any victim that visits the affected URL so the attacker can gain unauthorized access to that user's account through the stolen cookie...

Cross site scripting

The package s-cart/s-cart before 6.9; the package s-cart/core before 6.9 are vulnerable to Cross-site Scripting XSS which can lead to cookie stealing of any victim that visits the affected URL so the attacker can gain unauthorized access to that user's account through the stolen cookie...