515 matches found
CVE-2022-30134
Microsoft Exchange Server Information Disclosure Vulnerability...
Hostname Spoofing
Description parse-url parses following https url incorrectly, identifies its protocol as ssh, and its host name is parsed incorrectly either. https://www.google.com:[email protected]:x node -e 'const parseUrl=require"parse-url";console.logparseUrl"https://www.google.com:[email protected]:x"' protocols:...
AZL-10332 CVE-2021-33462 affecting package yasm 1.3.0-17
An issue was discovered in yasm version 1.3.0. There is a use-after-free in exprtraversenodespost in libyasm/expr.c...
GHSA-MJJJ-6P43-VHHV Prototype Pollution in deep-get-set
All versions of package deep-get-set are vulnerable to Prototype Pollution via the 'deep' function. Note: This vulnerability derives from an incomplete fix of CVE-2020-7715...
CVE-2022-30709
Improper input validation check logic vulnerability in SECRIL prior to SMR Jun-2022 Release 1 allows attackers to trigger crash...
UBUNTU-CVE-2022-28652
/.config/apport/settings parsing is vulnerable to "billion laughs" attack...
Apache XML Security For Java vulnerable to authentication bypass by HMAC truncation
The design of the W3C XML Signature Syntax and Processing XMLDsig recommendation, as implemented in multiple products. The Apache XML Security Java is affected by the vulnerability published in US-Cert VU 466161. See: http://www.kb.cert.org/vuls/id/466161 for more information. This bug can allow ...
OWASP ESAPI 安全漏洞
OWASP ESAPI is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. cross-site scripting vulnerabilities exist in versions of OWASP ESAPI prior to 2.3.0.0, which originate from the " onsiteURL" regular expression erro...
DEBIAN-CVE-2022-23457
ESAPI The OWASP Enterprise Security API is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of Validator.getValidDirectoryPathString, String, File, boolean may incorrectly treat the tested input string as a child of the specified...
CVE-2022-24538
Windows Cluster Shared Volume CSV Denial of Service Vulnerability...
CVE-2022-27829
Improper validation vulnerability in VerifyCredentialResponse prior to SMR Apr-2022 Release 1 allows attackers to launch certain activities...
Mbed TLS SSL/TLS Certificate Validation
The vulnerability of TLS and SSL Mbed TLS implementations is related to the incorrect use of the revocationDate check. Exploiting this vulnerability allows a remote attacker to compromise the integrity of data...
CVE-2022-22653
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.4 and iPadOS 15.4. A malicious website may be able to access information about the user and their devices...
USN-5288-1 expat vulnerabilities
It was discovered that Expat incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code...
CVE-2021-26322
Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”...
CLSA-2021-1634922899 Update of openssl
Always check certificates from local root store first...
CVE-2021-30906
This issue was addressed with improved checks. This issue is fixed in iOS 15.1 and iPadOS 15.1, macOS Monterey 12.0.1, tvOS 15.1, watchOS 8.1, macOS Big Sur 11.6.1. A local attacker may be able to elevate their privileges...
ARM mbed TLS 安全漏洞
ARM mbed TLS is a product from ARM UK that provides secure communication and encryption for mbed products. A security vulnerability exists in ARM mbed TLS versions prior to 2.24.0, which stems from a lack of clearing of the plaintext buffer in mbedtlssslread to erase unused application data from...
UBUNTU-CVE-2021-30797
This issue was addressed with improved checks. This issue is fixed in iOS 14.7, Safari 14.1.2, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7. Processing maliciously crafted web content may lead to code execution...