4102 matches found
OSV-2022-321 Stack-use-after-scope in std::__1::__function::__func<bool grk::WaveletReverse::decompress_partial_tile<g
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46468 Crash type: Stack-use-after-scope WRITE 1 Crash state: std::1::function::funcbool grk::WaveletReverse::decompresspartialtileg tf::Executor::invoke tf::Executor::consumetask...
CVE-2022-23440
A use of hard-coded cryptographic key vulnerability CWE-321 in the registration mechanism of FortiEDR collectors versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allow a local attacker to disable and uninstall the collectors from the end-points within the same deployment...
CVE-2022-25570
In Click Studios SA Pty Ltd Passwordstate 9435, users with access to a passwordlist can gain access to additional password lists without permissions. Specifically, an authenticated user who has write permissions to a password list in one folder with the default permission model can extend his...
CVE-2022-25570
In Click Studios SA Pty Ltd Passwordstate 9435, users with access to a passwordlist can gain access to additional password lists without permissions. Specifically, an authenticated user who has write permissions to a password list in one folder with the default permission model can extend his...
PT-2022-16863
Name of the Vulnerable Software and Affected Versions sysend.js versions prior to 1.10.0 Description The issue affects users who use cross-origin communication, potentially allowing their communications to be intercepted. However, the impact is limited because the communication occurs within the...
Design/Logic Flaw
NVIDIA distributions of Jetson Linux contain a vulnerability where an error in the IOMMU configuration may allow an unprivileged attacker with physical access to the board direct read/write access to the entire system address space through the PCI bus. Such an attack could result in denial of...
HackerOne: An attacker can archive and unarchive any structured scope object on HackerOne
Summary: Hello, I have discovered an IDOR vulnerability that allows the scope of any program to be archived. Scopes are used to give information about the valid scopes of a program. For example HackerOne has the following scopes: https://hackerone.com https://api.hackerone.com ... Steps To...
5 things to consider in performance comparisons
Most people can probably relate to asking a child to handle a chore, only to have the kid come back way too soon, saying it's done. Or maybe you can relate to being that child. Either way, you know what comes next: checking shows the job was handled poorly, and it all goes downhill from there. It...
OSV-2022-146 Stack-use-after-scope in tag_cfa_pattern::Put
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44590 Crash type: Stack-use-after-scope READ 1 Crash state: tagcfapattern::Put dngtiffdirectory::Put dngimagewriter::WriteTIFFWithProfile...
MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECT_LEX::nest_level is local to each VIEW.
...
CVE-2021-46517
There is an Assertion mjsstacksize&mjs-;scopes 0' failed at src/mjsexec.c in Cesanta MJS v2.20.0...
Directory Traversal
http-server-node is vulnerable to directory traversal. The vulnerability exists due to lack of sanitization of user inputs which allows an attacker to gain access to the files outside of the server scope...
GHSA-HCXX-MP6G-6GR9 Opencast publishes global system account credentials
The issue was mostly mitigated before, drastically reducing the risk. See references below for more information. Impact Opencast before version 10.6 will try to authenticate against any external services listed in a media package when it is trying to access the files, sending the global system...
CVE-2021-43051
The Spotfire Server component of TIBCO Software Inc.'s TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows malicious custom API clients with network access to execute internal API operations outside of the scope of thos...
HPE StoreServ Management Console和Manage 代码注入漏洞
HPE StoreServ Management Console SSMC is a professional storage array fast management and processing tools from the United States hpe HPE. The software enables the creation of logical volumes, daily patrols, and other operations on related storage. A code injection vulnerability exists in the HPE...
OPENSUSE-SU-2021:1525-1 Security update for singularity
This update for singularity fixes the following issues: Update to 3.8.5: - CVE-2021-41190: Fixed OCI manifest and index parsing confusion boo1193273. - Building Singularity from source requires go greater or equal 1.16. We now aim to support the two most recent stable versions of Go. This...
Moderate: Red Hat Security Advisory: ACS 3.67 security and enhancement update
Updated images are now available for Red Hat Advanced Cluster Security for Kubernetes RHACS. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
Hardcoded credentials
NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller, which may allow a user with elevated privileges to instantiate a DMA write operation only within a specific time window timed to corrupt code execution, which may impact confidentiality, integrity, or...
ALEA-2021:4200 new module: nodejs:16
This enhancement update adds the nodejs:16 module to AlmaLinuxas a Technology Preview. A future update will provide a Long Term Support LTS version of Node.js 16, which will be fully supported. BZ1953991 For detailed information on changes in this release, see the AlmaLinux Release Notes linked...
new module: nodejs:16
An update is available for nodejs-nodemon, nodejs, nodejs-packaging. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list This enhancement update adds the nodejs:16...