IBM QRadar SIEM 跨站脚本漏洞

IBM QRadar SIEM is a solution from IBM USA that leverages security intelligence to protect assets and information from advanced threats. The solution provides monitoring of the entire scope of the IT architecture, generating detailed reports on data access and user activity, etc. A cross-site...

CVE-2022-1343

creationtimestamp| type| source ---|---|--- 2022-05-03 20:34:04+00:00| seen| https://t.me/cibsecurity/41832...

jhead 缓冲区错误漏洞

jhead is a tool for modifying JPEG file information. A buffer error vulnerability exists in jhead version 3.04 and jpgfile.c version 3.05, which stems from a heap-based buffer overflow vulnerability in the RemoveUnknownSections function in jpgfile.c. The vulnerability is caused by a heap-based...

CVE-2021-38265

Cross-site scripting XSS vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrary web script or HTML when creating a collection page via the comliferayassetlistwebportletAssetListPortlettitle parameter...

CVE-2022-21398

Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications component: Mediation Engine. Supported versions that are affected are 3.4, 4.2, 4.3, 4.4 and 5.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromi...

Infinite loop in the RTMPT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file

...

DEBIAN-CVE-2022-21664

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of the classes, there's potential for unintended SQL queries to be executed. This has been patched in WordPress version 5.8.3. Older affected...

PT-2022-10054 · Mcafee · Mcafee Application/Change Control

Name of the Vulnerable Software and Affected Versions: McAfee Application and Change Control MACC versions prior to 8.3.4 Description: A security issue allows a locally logged-in attacker to bypass application protection, enabling them to run applications that would normally be blocked. The...

Wireshark 缓冲区错误漏洞

Wireshark formerly Ethereal is a set of network packet analysis software from the Wireshark team. Wireshark versions 3.6.0 and 3.4.0 - 3.4.10 contain an injection vulnerability that stems from a crash in the Sysdig event parser. An attacker could exploit this vulnerability to cause a denial of...

OPENSUSE-SU-2021:1426-1 Security update for dnsmasq

This update for dnsmasq fixes the following issues: Update to version 2.86 - CVE-2021-3448: fixed outgoing port used when --server is used with an interface name. bsc1183709 - CVE-2020-14312: Set --local-service by default bsc1173646. - Open inotify socket only when used bsc1180914. This update w...

CVE-2021-34736

creationtimestamp| type| source ---|---|--- 2021-10-21 07:36:18+00:00| seen| https://t.me/cibsecurity/30929...

CVE-2021-29750

IBM QRadar SIEM 7.3 and 7.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 201778...

CVE-2020-19157

Cross Site Scripting CSS in Wenku CMS v3.4 allows remote attackers to execute arbitrary code via the 'Intro' parameter for the component '/index.php?m=ucenter&a=index'...

CVE-2021-3049

An improper authorization vulnerability in the Palo Alto Networks Cortex XSOAR server enables an authenticated network-based attacker with investigation read permissions to download files from incident investigations of which they are aware but are not a part of. This issue impacts: All Cortex...

drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6 allows physically proximate attackers to cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain situations.

...

PYSEC-2021-305

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of division in TFLite is vulnerable to a division by 0 error. There is no check that the divisor tensor does not contain zero elements. We have patched the issue in GitHub commit...

PYSEC-2021-589

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.SparseFillEmptyRows. The shape inference implementation does not validate that the input arguments are not empt...

PYSEC-2021-260

TensorFlow is an end-to-end open source platform for machine learning. Sending invalid argument for rowpartitiontypes of tf.rawops.RaggedTensorToTensor API results in a null pointer dereference and undefined behavior. The implementation accesses the first element of a user supplied list of values...

PYSEC-2021-282

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause a floating point exception by calling inplace operations with crafted arguments that would result in a division by 0. The implementation has a logic error: it should skip processing i...

CVE-2021-24386

The WP SVG images WordPress plugin before 3.4 did not sanitise the SVG files uploaded, which could allow low privilege users such as author+ to upload a malicious SVG and then perform XSS attacks by inducing another user to access the file directly. In v3.4, the plugin restricted such upload to...