CVE-2022-26184

CVE-2022-26184 affects Poetry v1.1.9 and earlier. The issue is an untrusted search path that causes Poetry commands to behave unexpectedly when run in directories containing malicious content on Windows. The incident is documented with high CVSS impacts (confidentiality, integrity, availability) ...

CVE-2022-26184

Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS...

CVE-2022-26184: Untrusted Search Path

Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS...

CVE-2021-43106

A Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online TWO 5.3.33.3 F38 and FIMI 4.2.19.4 25.The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would just cause the...

PT-2022-11787

Name of the Vulnerable Software and Affected Versions Compass Plus TranzWare Online FIMI Web Interface Tranzware Online TWO version 5.3.33.3 F38 Compass Plus TranzWare Online FIMI Web Interface FIMI version 4.2.19.4 25 Description A Header Injection issue exists, allowing manipulation of the HTTP...

PT-2024-10535

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the NFSD component of the Linux kernel, specifically with the handling of large file sizes in NFSv3 SETATTR/CREATE procedures. The iattr::ia size is a loff t, and...

Use of deprecated Chainlink's latestAnswer API

Handle UncleGrandpa925 Vulnerability details Issue In EIP1271Wallet.sol, the function validateOrder uses the deprecated latestAnswer of Chainlink. This function might suddenly stop working if Chainlink stopped supporting it, and also will not error if no answer has been reached but returns 0...

CVE-2022-22637

A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iOS 15.4 and iPadOS 15.4, tvOS 15.4. A malicious website may cause unexpected cross-origin behavior...

Design/Logic Flaw

In sourcecodetester Engineers Online Portal as of 10-21-21, an attacker can manipulate the Host header as seen by the web application and cause the application to behave in unexpected ways. Very often multiple websites are hosted on the same IP address. This is where the Host Header comes in. Thi...

CVE-2021-43437

In sourcecodetester Engineers Online Portal as of 10-21-21, an attacker can manipulate the Host header as seen by the web application and cause the application to behave in unexpected ways. Very often multiple websites are hosted on the same IP address. This is where the Host Header comes in. Thi...

PT-2021-23843

Name of the Vulnerable Software and Affected Versions sourcecodetester Engineers Online Portal affected versions not specified Description The issue allows an attacker to manipulate the Host header, causing the web application to behave in unexpected ways. This is particularly relevant when...

CVE-2021-43437: Improper Neutralization of Special Elements in Output Used by a Downstream Component

In sourcecodetester Engineers Online Portal as of 10-21-21, an attacker can manipulate the Host header as seen by the web application and cause the application to behave in unexpected ways. Very often multiple websites are hosted on the same IP address. This is where the Host Header comes in. Thi...

CVE-2021-4044

Internally libssl in OpenSSL calls X509verifycert on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error for example out of memory. Such a negative return value is mishandled by OpenSSL and will cause an IO...

PT-2021-17016

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned. Description A malicious hypervisor, in conjunction with an unprivileged attacker process inside an SEV/SEV-ES guest VM, may fail to flush the Translation Lookaside Buffer TLB, resulting in...

CVE-2021-26340: Undefined Security Weakness

A malicious hypervisor in conjunction with an unprivileged attacker process inside an SEV/SEV-ES guest VM may fail to flush the Translation Lookaside Buffer TLB resulting in unexpected behavior inside the virtual machine VM...

MGASA-2021-0519 Updated php packages fix security vulnerability

Header injection via defaultmimetype / defaultcharset mbstring may use pointer from some previous request Unexpected behavior with arrays and JIT Special character is breaking the path in xml function CVE-2021-21707 XMLReader::getParserProperty may throw with a valid property...

MAM SDK Migration Unexpected behavior on MDX/MAM SDK app container

Some interaction between managed applications in the same container are not working properly for example, copy and paste, open-in, etc. Scenario 1: Productivity Apps only using Hybrid mode One app on Legacy MDX and one app on MAM SDK. This scenario is not supported and not recommended. Scenario 2...

Erc20.transfer() return value is ignored

Handle pants Vulnerability details According to the ERC-20 Token Standard, the function transfer returns false on failure. However, the return value of Erc20.transfer is ignored 8 times: 1. In Swivel.exitVaultFillingZcTokenExit, line 313. 2. In Swivel.exitVaultFillingZcTokenExit, line 315. 3. In...

CVE-2021-22684

Tizen RT RTOS version 3.0.GBB is vulnerable to integer wrap-around in functionscalloc and mmzalloc. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash...

CVE-2021-22684

CVE-2021-22684 affects Samsung Tizen RT RTOS 3.0.GBB. It is caused by integer wrap-around in memory allocation helpers calloc and mm_zalloc, leading to improper memory assignment and potential arbitrary memory allocation or a crash. Connected sources confirm the vulnerability and CVE assignment; ...