The vulnerability of the Rizin command-line tool set relates to the execution of operations beyond the buffer in memory, allowing an attacker to execute arbitrary code.

The vulnerability of the Rizin command-line tool set is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

The vulnerability of the FortiOS operating system arises from the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows attackers to execute arbitrary commands.

The vulnerability of the FortiOS operating system exists due to the lack of measures taken to neutralize the special elements used in the operating system’s commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2022-20423

In rndissetresponse of rndis.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious USB device is attached with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

UBUNTU-CVE-2022-20423

In rndissetresponse of rndis.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious USB device is attached with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

PT-2022-25387 · Mxgraph · Mxgraph

Name of the Vulnerable Software and Affected Versions: mxGraph version 4.2.2 Description: The issue is related to a cross-site scripting XSS vulnerability. It occurs via the setTooltips function, which is susceptible to XSS attacks. Recommendations: For mxGraph version 4.2.2, consider disabling t...

mxGraph 跨站脚本漏洞

mxGraph is a JavaScript charting library. A security vulnerability exists in mxGraph version v4.2.2, which stems from the discovery of a cross-site scripting XSS vulnerability contained via the setTooltips function...

PT-2022-04: Cross Site Template Injection (CSTI)

Input validation was missing while creating the working set, in working set manager application. Nokia NetAct users can create a Working Set with a name that injects a client-side template Injection payloads. The attack can only be performed by an internal user. The vulnerability is fixed in NetA...

Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2022-2413)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2022-6442 · Nokia · Netact

Name of the Vulnerable Software and Affected Versions: Nokia NetAct versions prior to 22 FP2211 Description: The issue is related to the lack of input validation when creating a working set in the NetAct system, allowing an attacker to inject a client-side template payload. This can lead to the...

EulerOS Virtualization 3.0.6.6 : grub2 (EulerOS-SA-2022-2504)

According to the versions of the grub2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may take advantage of that to...

TOTOLINK NR1800X setTracerouteCfg method buffer overflow vulnerability

TOTOLINK NR1800X is a 5G NR indoor Wi-Fi and SIP CPE broadband access device from China's Gion Electronics TOTOLINK, which is mainly used for the deployment of NR fixed data services in homes and offices to support 5G NR network connectivity. The TOTOLINK NR1800X suffers from a buffer overflow...

CVE-2022-39847

Use after free vulnerability in setnftpid and signalhandler function of NFC driver prior to SMR Oct-2022 Release 1 allows attackers to perform malicious actions...

CVE-2022-39847

Use after free vulnerability in setnftpid and signalhandler function of NFC driver prior to SMR Oct-2022 Release 1 allows attackers to perform malicious actions...

Information Disclosure

codeigniter4/framework is vulnerable to information disclosure. The vulnerability exists in the setcookie function because it does not reflect setting $secure or $httponly values to true in config or cookie, which exposes them to scripts, allowing an attacker to gain access to internal data...

SAMSUNG Mobile devices 资源管理错误漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc. from the South Korean company Samsung. A security vulnerability exists in SAMSUNG Mobile devices SMR Oct-2022 Release 1, which stems from the use of after free vulnerability in the setnftpid and...

PT-2022-24128 · Aruba · Aruba Instant +1

Name of the Vulnerable Software and Affected Versions: Aruba InstantOS versions 6.4.4.8 through 4.2.4.20 and below Aruba InstantOS versions 6.5.4.23 and below Aruba InstantOS versions 8.6.0.18 and below Aruba InstantOS versions 8.7.1.9 and below Aruba InstantOS versions 8.10.0.1 and below ArubaOS...

CVE-2022-41523

TOTOLINK NR1800X V9.1.0u.6279B20210910 was discovered to contain an authenticated stack overflow via the command parameter in the setTracerouteCfg function...

CVE-2022-41524

TOTOLINK NR1800X V9.1.0u.6279B20210910 was discovered to contain an authenticated stack overflow via the week, sTime, and eTime parameters in the setParentalRules function...

CVE-2022-41517

TOTOLINK NR1800X V9.1.0u.6279B20210910 was discovered to contain a stack overflow in the lang parameter in the setLanguageCfg function...

protobuf-java: potential DoS in the parsing procedure for binary data

A flaw was found in protobuf-java. Google Protocol Buffer protobuf-java allows the interleaving of com.google.protobuf.UnknownFieldSet fields. By persuading a victim to open specially-crafted content, a remote attacker could cause a timeout in the ProtobufFuzzer function, resulting in a denial of...