The vulnerability of the ConfigFileUpload() function in the web interface for managing D-Link DIR-1935 router microprogramming software allows a hacker to execute arbitrary code.

The vulnerability of the ConfigFileUpload function in the web interface for managing D-Link DIR-1935 router microprogramming software is related to the use of uncontrolled format strings. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

LodaRAT Malware Resurfaces with New Variants Employing Updated Functionalities

The LodaRAT malware has resurfaced with new variants that are being deployed in conjunction with other sophisticated malware, such as RedLine Stealer and Neshta. "The ease of access to its source code makes LodaRAT an attractive tool for any threat actor who is interested in its capabilities,"...

xorg-x11-server: buffer overflow in _GetCountedString() in xkb/xkb.c

A flaw was found in the xorg-x11-server package. A buffer overflow can occur in the GetCountedString function in xkb/xkb.c due to improper input validation, allowing for possible escalation of privileges, execution of arbitrary code, or a denial of service...

httpd: Out-of-bounds read in ap_strcmp_match()

An out-of-bounds read vulnerability was found in httpd. A very large input to the apstrcmpmatch function can lead to an integer overflow and result in an out-of-bounds read...

GSD-2022-1007440 RISC-V: Make port I/O string accessors actually work

RISC-V: Make port I/O string accessors actually work This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.220 by commit...

GSD-2022-1007320 RISC-V: Make port I/O string accessors actually work

RISC-V: Make port I/O string accessors actually work This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.150 by commit...

GSD-2022-1007142 RISC-V: Make port I/O string accessors actually work

RISC-V: Make port I/O string accessors actually work This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.75 by commit...

GSD-2022-1006912 RISC-V: Make port I/O string accessors actually work

RISC-V: Make port I/O string accessors actually work This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.3 by commit...

PT-2022-35660 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.220 Description: The issue is related to a dangling pnp string in the f printer.c file of the Linux Kernel. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

PT-2022-35373 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.10 through v5.15.74 Description: The issue concerns reading strings from synthetic events. It was introduced in version v5.10 and fixed in version v5.15.75. The actual impact and attack plausibility have not yet been...

PT-2022-35319 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.75 Description: The issue is related to a dangling pnp string in the f printer.c file of the Linux Kernel. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

PT-2022-35520 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.150 Description: The issue is related to a dangling pnp string in the f printer.c file of the Linux Kernel. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

PT-2022-35695 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.220 Description: The issue concerns the RISC-V port I/O string accessors in the Linux Kernel, which may have potential security implications. The actual impact and attack plausibility have not yet been...

PT-2022-35397 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.75 Description: The issue concerns the RISC-V port I/O string accessors in the Linux Kernel, which may have potential security implications. The actual impact and attack plausibility have not yet been...

PT-2022-35063 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue is related to the use of snprintf instead of scnprintf. It was introduced in version v4.10 and fixed in version v6.0.3. The actual impact and attack plausibility have not yet been...

PT-2022-35765 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.262 Description: The issue is related to a dangling pnp string in the f printer.c file of the Linux Kernel. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

The vulnerability of the _convert_from_str() function in the numpy.core module of the NumPy library allows a hacker to initiate data copying.

The vulnerability of the convertfromstr function in the numpy.core module of the NumPy library for Python is related to incorrect string comparisons. Exploiting this vulnerability could allow a malicious actor to initiate data copying through specially created objects...

CLSA-2022-1668118023 Fix CVE(s): CVE-2022-35737

SECURITY UPDATE: array-bounds overflow if billions of bytes are used in a string argument to a C API - debian/patches/CVE-2022-35737.patch: increase the size of loop variables in the printf implementation to avoid overflow. - CVE-2022-35737...

Meta ReDex 缓冲区错误漏洞

Meta ReDex is an Android bytecode dex optimizer from Meta USA. Meta ReDex suffers from a security vulnerability that stems from the possibility of loading an out-of-bounds address when loading a string index table, which could allow remote code execution when processing third-party Android APK...

nodejs: Certificate Verification Bypass via String Injection

It was found that node.js did not safely read the x509 certificate generalName format properly, resulting in data injection. A certificate could use a specially crafted extension in order to be successfully validated, permitting an attacker to impersonate a trusted host...