CVE-2023-22291: Free of Memory not on the Heap

An invalid free vulnerability exists in the Frame stream parser functionality of Ichitaro 2022 1.0.1.57600. A specially crafted document can lead to an attempt to free a stack pointer, which causes memory corruption. An attacker can provide a malicious file to trigger this vulnerability...

PT-2023-18402 · Unknown · Ichitaro 2022

Name of the Vulnerable Software and Affected Versions: Ichitaro 2022 version 1.0.1.57600 Description: An invalid free vulnerability exists in the Frame stream parser functionality. A specially crafted document can lead to an attempt to free a stack pointer, which causes memory corruption. An...

JustSystems Corporation Ichitaro Frame stream parser invalid free vulnerability

Talos Vulnerability Report TALOS-2022-1687 JustSystems Corporation Ichitaro Frame stream parser invalid free vulnerability April 5, 2023 CVE Number CVE-2023-22291 SUMMARY An invalid free vulnerability exists in the Frame stream parser functionality of Ichitaro 2022 1.0.1.57600. A specially crafte...

Amazon Linux 2 : xstream (ALAS-2023-2007)

The version of xstream installed on the remote host is prior to 1.3.1-16. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2007 advisory. XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the...

postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file permissions

A flaw was found in org.postgresql. This issue allows the creation of a temporary file when using PreparedStatement.setTextint, InputStream and PreparedStatemet.setByteaint, InputStream. This could allow a user to create an unexpected file available to all users, which could end in unexpected...

PT-2025-37901

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s SCTP Stream Control Transmission Protocol implementation. Specifically, the issue arises from a corner case where the association asoc out stream coun...

arrow:arrow-ipc-stream-fuzz: Crash in arrow::internal::CountSetBits

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=4587041030799360 Project: arrow Fuzzing Engine: libFuzzer Fuzz Target: arrow-ipc-stream-fuzz Job Type: libfuzzerubsanarrow Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0000027a1000 Cras...

MAL-2023-840 Malicious code in tdv2-applet-stream (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44d9f0f475f31c69d603b6953d97d1b896179620b901a811fd032be0a22d9003 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-841 Malicious code in tdv2-applet-stream-her (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 61f1a3a4e828660101ffe77b0a2ddc778e1877603d971ba4e76e4f7d85692a34 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tdv2-applet-stream (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44d9f0f475f31c69d603b6953d97d1b896179620b901a811fd032be0a22d9003 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in tdv2-applet-stream-her

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in tdv2-applet-stream

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Directory Traversal File Write Vulnerability

Exploit Title: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Directory Traversal File Write Exploit Exploit Author: LiquidWorm Vendor: SOUND4 Ltd. Product web page: https://www.sound4.com | https://www.sound4.biz Affected version: FM/HD Radio Processing: Impact/Pulse/First Version 2: 1.1/2.15...

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Denial Of Service (DoS)

Exploit Title: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Denial Of Service DoS Exploit Author: LiquidWorm Vendor: SOUND4 Ltd. Product web page: https://www.sound4.com | https://www.sound4.biz Affected version: FM/HD Radio Processing: Impact/Pulse/First Version 2: 1.1/2.15 Impact/Pulse/First Version 1:...

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Authorization Bypass (IDOR)

Exploit Title: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Authorization Bypass IDOR Exploit Author: LiquidWorm Vendor: SOUND4 Ltd. Product web page: https://www.sound4.com | https://www.sound4.biz Affected version: FM/HD Radio Processing: Impact/Pulse/First Version 2: 1.1/2.15 Impact/Pulse/First Versio...

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Directory Traversal File Write Exploit

Exploit Title: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Directory Traversal File Write Exploit Exploit Author: LiquidWorm Vendor: SOUND4 Ltd. Product web page: https://www.sound4.com | https://www.sound4.biz Affected version: FM/HD Radio Processing: Impact/Pulse/First Version 2: 1.1/2.15...

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Denial Of Service Vulnerability

Exploit Title: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Denial Of Service DoS Exploit Author: LiquidWorm Vendor: SOUND4 Ltd. Product web page: https://www.sound4.com | https://www.sound4.biz Affected version: FM/HD Radio Processing: Impact/Pulse/First Version 2: 1.1/2.15 Impact/Pulse/First Version 1:...

Security Bulletin: Vulnerability in Linux Kernel affects SAN Volume Controller, Storwize family and FlashSystem V9000 products (CVE-2016-5696)

Summary Vulnerability CVE-2016-5696 in the Linux kernel affects SAN Volume Controller, Storwize family and FlashSystem V9000 products' IP interface. Vulnerability Details CVEID: CVE-2016-5696 DESCRIPTION: Linux Kernel could allow a remote attacker to obtain sensitive information, caused by the...

PDF-XChange Editor buffer error vulnerability

Tracker Software PDF-XChange Editor is a suite of software for viewing and editing PDF format files from Tracker Software, a Canadian company. A buffer error vulnerability exists in PDF-XChange Editor, which is caused by a buffer overflow problem in the parsing of JPC files...

Tapo C310 RTSP Server 1.3.0 Unauthorized Video Stream Access

Exploit Title: Tapo C310 RTSP server v1.3.0- Unauthorised Video Stream Access Date: 19th July 2022 Exploit Author: dsclee1 Vendor Homepage: tp-link.com Software Link: http://download.tplinkcloud.com/firmware/TapoC310v1en1.3.0Build220328Rel.64283nu1649923652150.bin Version: 1.3.0 Tested on: Linux ...