12021 matches found
aalborgstift.dk Cross Site Scripting vulnerability OBB-2841857
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Meet new Wiz board member Emily Heath
Q&A: Why Wiz caught the attention of DocuSign’s Former CTSO...
编号已被CVE保留
No details are available at this time...
Previous {Operators/Weights/Threshold} Are Still Able To Sign Off New Commands After Operatorship Is Transferred
Lines of code Vulnerability details The administrator will call AxelarAuthWeighted.transferOperatorship function to transfer the operatorship to a new set of Operators/Weights/Threshold. However, it was observed that after transferring the operatorship to a new set of Operators/Weights/Threshold,...
GSD-2022-1004874 can: gs_usb: gs_usb_open/close(): fix memory leak
can: gsusb: gsusbopen/close: fix memory leak This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.288 by commit...
GSD-2022-1004745 erspan: do not assume transport header is always set
erspan: do not assume transport header is always set This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.202 by commit...
GSD-2022-1004630 erspan: do not assume transport header is always set
erspan: do not assume transport header is always set This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.127 by commit...
[SECURITY] Fedora 36 Update: golang-github-gojuno-minimock-3.0.10-4.fc36
Powerful mock generation tool for Go programming language...
CVE-2022-34568
SDL v1.2 was discovered to contain a use-after-free via the XFree function at /src/video/x11/SDLx11yuv.c...
OSV-2022-608 Heap-use-after-free in jxl::WriteToPixelCallbackStage::ProcessRow
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49277 Crash type: Heap-use-after-free READ 4 Crash state: jxl::WriteToPixelCallbackStage::ProcessRow jxl::LowMemoryRenderPipeline::RenderRect jxl::LowMemoryRenderPipeline::ProcessBuffers...
OSV-2022-604 Stack-buffer-overflow in sc_asn1_read_tag
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49248 Crash type: Stack-buffer-overflow READ 1 Crash state: scasn1readtag scasn1findtag cardoslistfiles...
New Air-Gap Attack Uses SATA Cable as an Antenna to Transfer Radio Signals — The Hacker News
A new method devised to leak information and jump over air-gaps takes advantage of Serial Advanced Technology Attachment SATA or Serial ATA cables as a communication medium, adding to a long list of electromagnetic, magnetic, electric, optical, and acoustic methods already demonstrated to plunder...
Possible casting overflow in _updateAccounting function
Lines of code Vulnerability details Impact In the updateAccounting function, the inkOut and artIn parameters are cast from type uint256 to uint128. However, since the explicit cast does not ensure the value fits the uint128 data type i.e., not ensuring value = typeuint128.max, casting overflows a...
minInkOut parameter will likely cause revert
Lines of code Vulnerability details Impact In payBase, the user is able to supply maxBaseIn and minInkOut params. There is logic in the function that if the user has attempted to send more base than the cauldron currently needs, then it only takes the amount of base necessary. // If offering too...
parse-url cross-site scripting vulnerability
parse-url is an advanced url parser with git url support. A cross-site scripting vulnerability exists in parse-url versions prior to 7.0.0, which stems from the ability to run malicious JS code using ASCII characters starting with and all special escape characters starting with Unicode, which can...
Jenkins Deployment Dashboard信息泄露漏洞
Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project. jenkins Plugin is an application. an information disclosure vulnerability...
VICIdial Cross-Site Scripting Vulnerability
Vicidial is a software suite from Vicidial, Inc. Designed to interact with the Asterisk open source Pbx phone system as a complete inbound/outbound contact center suite with inbound email support. A cross-site scripting vulnerability exists in VICIdial versions prior to 2.14b0.5, which stems from...
CVE-2022-35230
An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict...