13092 matches found
CVE-2022-3290 Improper Handling of Length Parameter Inconsistency in ikus060/rdiffweb
Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8...
Improper Input Validation
pywasm3 is vulnerable to improper input validation. The vulnerability exists in wasm3/source/m3exec.h because the user inputs are not properly validated which allows an attacker to bypass url with wrong information...
GHSA-HR3V-8CP3-68RF HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions
HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 did not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2...
HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions
HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 did not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2...
CVE-2022-32816
The issue was addressed with improved UI handling. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. Visiting a website that frames malicious content may lead to UI spoofing...
CVE-2022-32828
The issue was addressed with improved memory handling. This issue is fixed in iOS 15.6 and iPadOS 15.6, tvOS 15.6, macOS Monterey 12.5. An app may be able to disclose kernel memory...
SUSE-SU-2022:3353-1 Security update for permissions
This update for permissions fixes the following issues: - CVE-2022-31252: Fixed chkstat group controlled paths bsc1203018...
Liferay Portal and Liferay DXP HtmlUtil.escapeRedirect Can Be Circumvented
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users t...
Liferay Portal and Liferay DXP Vulnerable to XSS via the filter_ Prefix
Multiple cross-site scripting XSS vulnerabilities in Liferay Fragment Renderer Collection Filter Implementation before v1.0.11 from Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters with the filter prefix...
OSV-2022-931 Heap-buffer-overflow in file_magwarn
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51674 Crash type: Heap-buffer-overflow READ Crash state: filemagwarn load1 apprenticeload...
Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2016-3426, CVE-2016-3427)
Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...
MAL-2022-3824 Malicious code in ing-ges6-mfe-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 880d16785b99e2842b3d1a9e8ed8d2a47003ee40be7922518e20d69adccf2135 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
It’s time to bite the bullet for more secure software
On September 14, 2022, the Office of Management and Budget OMB released their M-22-18 memorandum on "Enhancing the Security of the Software Supply Chain through Secure Software Development Practices." This document builds upon previous government documents such as Executive Order EO 14028...
CVE-2022-37259
A Regular Expression Denial of Service ReDoS flaw was found in stealjs steal 2.2.4 via the string variable in babel.js...
Buffer Overflow
fis-gtm is vulnerable to buffer overflow. The vulnerability exist inutilformat function in utilouput.c where the attacker can control the size of the memset by using a crafted input...
CVE-2022-40805
The d8s-urls for python 0.1.0, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-hypothesis package...
Input validation
Safe Software FME Server v2021.2.5 and below does not employ server-side validation...
CVE-2022-25873 Cross-site Scripting (XSS)
The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting XSS due to improper input sanitization in the 'eventName' function within the VCalendar component...
GSD-2022-1006239 powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address
powerpc/cell/axonmsi: Fix refcount leak in setupmsimsgaddress This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.291 by commit...