CISA Releases Fifteen Industrial Control Systems Advisories

CISA released fifteen 15 Industrial Control Systems ICS advisories on February 16, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. CISA encourages users and administrators to review the newly released ICS advisories f...

SUSE CVE-2007-6681

Stack-based buffer overflow in modules/demux/subtitle.c in VideoLAN VLC 0.8.6d allows remote attackers to execute arbitrary code via a long subtitle in a 1 MicroDvd, 2 SSA, and 3 Vplayer file...

SUSE CVE-2009-2841

The HTMLMediaElement::loadResource function in html/HTMLMediaElement.cpp in WebCore in WebKit before r49480, as used in Apple Safari before 4.0.4 on Mac OS X, does not perform the expected callbacks for HTML 5 media elements that have external URLs for media resources, which allows remote attacke...

SUSE CVE-2012-0445

Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to bypass the HTML5 frame-navigation policy and replace arbitrary sub-frames by creating a form submission target with a sub-frame's name attribute...

SUSE CVE-2016-9905

A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. This vulnerability affects Firefox ESR 45.6 and Thunderbird 45.6...

SUSE CVE-2019-18461

An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.3 when a sub group epic is added to a public group. It has Incorrect Access Control...

SUSE CVE-2021-20228

A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the nolog feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. The highest threat from this vulnerability...

The vulnerability of the Installation sub-component of the Oracle Collaborative Planning component of the Oracle E-Business Suite, a business automation system, allows an attacker to gain access to modify, add, or delete protected data.

The vulnerability of the Installation sub-component of the Oracle Collaborative Planning component in the Oracle E-Business Suite enterprise automation system is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to modify,...

PT-2023-3025 · D Link · D-Link Dir-882

Name of the Vulnerable Software and Affected Versions: D-Link DIR882 version DIR882A1 FW110B02 Description: The issue is related to a stack overflow in the sub 48AC20 function, which can be exploited to cause a Denial of Service DoS or execute arbitrary code via a crafted payload. This allows...

Fedora: Security Advisory for redis (FEDORA-2023-fbfe7a6cfe)

The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

RHEL 7 : ansible (RHSA-2020:0756)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0756 advisory. Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH a...

PT-2023-10557 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: The issue concerns buffer overflow vulnerabilities in the PubNub message handler for the "cc" channel. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow,...

PT-2022-27913 · Trendnet · Trendnet Tew755Ap

Name of the Vulnerable Software and Affected Versions: TRENDnet TEW755AP version 1.13B01 Description: A stack overflow issue was discovered via the REMOTE USER parameter in the get access sub 45AC2C function. Recommendations: For TRENDnet TEW755AP version 1.13B01, consider restricting access to t...

CVE-2022-46597

TRENDnet TEW755AP 1.13B01 was discovered to contain a command injection vulnerability via the sysservice parameter in the setupwizardmydlink sub4104B8 function...

Senayan Library Management System 9.1.1 SQL Injection Vulnerability

Title: Senayan Library Management System v9.1.1 a.k.a SLIMS 9 SQLi Author: nu11secur1ty Vendor: https://slims.web.id/web/ Software: https://github.com/slims/slims9bulian/releases/download/v9.1.1/slims9bulian-9.1.1.zip Reference:...

CVE-2022-46171 Tauri vulnerable to path traversal

Tauri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards , ?, and ... match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths. Scopes without the wildcards are not affected. As...

Tauri 路径遍历漏洞

Tauri is Tauri open source to build smaller, faster and more secure desktop applications using a web front end. Tauri has a path traversal vulnerability. Attackers use this vulnerability to obtain the contents of the path's sub-folder...

PT-2022-27785 · Tauri · Tauri

Name of the Vulnerable Software and Affected Versions: Tauri versions prior to the latest release Tauri versions 1.x prior to the backported patch Description: The filesystem glob pattern wildcards , ?, and ... match file path literals and leading dots by default, which unintentionally exposes su...

PT-2022-36766 · Git +1 · Gstreamer

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow write crash. The crash involves the functions parse subrip, parse webvtt, and gst sub parse chain...

Creating Awareness of External JavaScript Libraries in Web Applications

Qualys Web Application Scanning WAS routinely reviews and solicits customer feedback regarding vulnerabilities. This may be to enhance the detection or the detections reporting. Previously, all JavaScript libraries detected on an application are reported under the Information Gathering QID 150176...