Tauri 路径遍历漏洞

Tauri is Tauri open source to build smaller, faster and more secure desktop applications using a web front end. Tauri has a path traversal vulnerability. Attackers use this vulnerability to obtain the contents of the path's sub-folder...

CVE-2022-46171: Improper Limitation of a Pathname to a Restricted Directory

Tauri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards , ?, and ... match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths. Scopes without the wildcards are not affected. As...

PT-2022-27785 · Tauri · Tauri

Name of the Vulnerable Software and Affected Versions: Tauri versions prior to the latest release Tauri versions 1.x prior to the backported patch Description: The filesystem glob pattern wildcards , ?, and ... match file path literals and leading dots by default, which unintentionally exposes su...

PT-2022-36766 · Git +1 · Gstreamer

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow write crash. The crash involves the functions parse subrip, parse webvtt, and gst sub parse chain...

PT-2025-41036

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An information leak was identified in the Linux kernel related to the tipc topsrv kern subscr function. Specifically, an 8-byte write was not used to initialize the sub.usr handle...

Creating Awareness of External JavaScript Libraries in Web Applications

Qualys Web Application Scanning WAS routinely reviews and solicits customer feedback regarding vulnerabilities. This may be to enhance the detection or the detections reporting. Previously, all JavaScript libraries detected on an application are reported under the Information Gathering QID 150176...

Command Injection

snyk-go-plugin is vulnerable to command injection. The vulnerability exists in execute function of sub-process.js because shell for child processes is not properly disabled which allows an attacker to run arbitrary commands on the host system...

Authentication Bypass

firefox is vulnerable to authentication bypass. The vulnerability exists because certain pages do not have their FeaturePolicy fully initialized which allows an attacker to bypass the leaked device permissions into untrusted sub documents...

[SECURITY] Fedora 37 Update: redis-7.0.5-1.fc37

Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing se...

CVE-2022-40934

Online Pet Shop We App v1.0 is vulnerable to SQL injection via /petshop/classes/Master.php?f=deletesubcategory,id...

Online Pet Shop We App SQL注入漏洞

Online Pet Shop We App is an online pet store web application by Carlo Montero Personal Developer. A SQL injection vulnerability exists in Online Pet Shop We App version 1.0, which originates from a lack of validation of externally entered SQL statements in the...

CVE-2021-43565

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server...

The vulnerability of the Core sub-component of the Oracle VM VirtualBox allows a hacker to execute arbitrary code.

The vulnerability of the Core sub-component of the Oracle VM VirtualBox exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

mariadb: MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr

MariaDB through 10.5.9 allows an application crash in subselectpostjoinaggr for a NULL value of aggr...

[SECURITY] Fedora 36 Update: mqttcli-0.2.3-3.fc36

mqttcli provides two programs pub and sub that allow command-line access to an MQTT broker. sub subscribes to a topic and prints messages received to standard output. pub publishes the provided message to the provided topic. Both programs accept flags that can be provided as a config file...

PT-2022-37128

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash, specifically a Segv on an unknown address. The crash state involves several functions: mpz add, mpz sub, and mrb bint sub...

[PNM-002] The expiry of the parent node can be smaller than the one of a child node, violating the guarantee policy

Lines of code Vulnerability details Description By design, the child node's expiry can only be extended up to the parent's current one. Adding these restrictions means that the ENS users only have to look at the name itself's fuses and expiry without traversing the hierarchy to understand what...

When setSubnodeOwner transfers ownership of sub-domain the new owner can perform actions before fuses are burned

Lines of code Vulnerability details Impact Function NameWrapper.setSubnodeOwner can be used to transfer ownership of a sub-domain to a new owner and, at the same time, burn fuses. A possible use-case could be that a domain owner wants to transfer ownership of the sub-domain but burn fuses in orde...

Fedora: Security Advisory for golang-github-bobesa-domain-util (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: mqttcli-0.2.3-2.fc36

mqttcli provides two programs pub and sub that allow command-line access to an MQTT broker. sub subscribes to a topic and prints messages received to standard output. pub publishes the provided message to the provided topic. Both programs accept flags that can be provided as a config file...