CVE-2022-37197: Unquoted Search Path or Element

IOBit IOTransfer V4 is vulnerable to Unquoted Service Path...

CVE-2022-37197

CVE-2022-37197 concerns IOBit IOTransfer V4 with an Unquoted Service Path, specifically the IOTUpdaterSvc binary path (C:\Program Files (x86)\IOTransfer\Updater\IOTUpdater.exe). Public sources (NVD/Red Hat/CVE lists, Exploit-DB, PT Security) confirm a local vulnerability where an unquoted service...

CVE-2022-37197

IOBit IOTransfer V4 is vulnerable to Unquoted Service Path...

IOTransfer V4 - Unquoted Service Path Vulnerability

Exploit Title: IOTransfer V4 - Unquoted Service Path Exploit Author: BLAY ABU SAFIAN Inveteck Global Vendor Homepage: http://www.iobit.com/en/index.php Software Link: https://iotransfer.itopvpn.com/download/ Tested Version: V4 Vulnerability Type: Unquoted Service Path Tested on OS: Microsoft...

IOTransfer V4 - Unquoted Service Path

Exploit Title: IOTransfer V4 - Unquoted Service Path Exploit Author: BLAY ABU SAFIAN Inveteck Global Discovery Date: 2022-28-07 Vendor Homepage: http://www.iobit.com/en/index.php Software Link: https://iotransfer.itopvpn.com/download/ Tested Version: V4 Vulnerability Type: Unquoted Service Path...

GHSA-455W-C45V-86RG fastify vulnerable to denial of service via malicious Content-Type

Impact An attacker can send an invalid Content-Type header that can cause the application to crash, leading to a possible Denial of Service attack. Only the v4.x line is affected. This was updated: upon a close inspection, v3.x is not affected after all. Patches Yes, update to v4.8.0. Workarounds...

CVE-2022-35150

Baijicms v4 was discovered to contain an arbitrary file upload vulnerability...

Privilege escalation

Baijicms v4 was discovered to contain an arbitrary file upload vulnerability...

CVE-2022-35150

Baijicms v4 contains an arbitrary file upload vulnerability due to lack of validation of uploaded files. Reported across multiple sources (CNVD/CNNVD/NI CVD records) with potential for remote code execution and high impact (based on CVSS 3.1 metrics: AV:N, AC:L, PR:N, UI:N, S:U, C:H, I:H, A:H). E...

CVE-2022-35150

Baijicms v4 was discovered to contain an arbitrary file upload vulnerability...

Fedora: Security Advisory for podman-tui (FEDORA-2022-5038c3236c)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 36 Update: golang-github-cloudflare-0.21.0-4.fc36

A Go library for interacting with Cloudflare's API v4. This library allows you to: - Manage and automate changes to your DNS records within Cloudflare - Manage and automate changes to your zones domains on Cloudflare, includi ng adding new zones to your account - List and modify the status of WAF...

IOTransfer 4.0 - Remote Code Execution Exploit

Exploit Title: IOTransfer V4 – Remote Code Execution RCE Exploit Author: Tomer Peled Vendor Homepage: https://www.iobit.com Software Link: https://iotransfer.itopvpn.com/ Version: V4 and onward Tested on: Windows 10 CVE : 2022-24562 References:...

fastify-bearer-auth vulnerable to Timing Attack Vector

Impact fastify-bearer-auth does not securely use crypto.timingSafeEqual. A malicious attacker could estimate the length of one valid bearer token. According to the corresponding RFC 6750, the bearer token has only base64 valid characters, reducing the range of characters for a brute force attack...

CVE-2022-31127: Improper Neutralization of Input During Web Page Generation

NextAuth.js is a complete open source authentication solution for Next.js applications. An attacker can pass a compromised input to the e-mail signin endpoint that contains some malicious HTML, tricking the e-mail server to send it to the user, so they can perform a phishing attack. Eg.:...

[SECURITY] Fedora 36 Update: podman-tui-0.4.0-2.fc36

podman-tui is a terminal user interface for Podman v4. podman-tui is using podman.socket service to communicate with podman environm ent and SSH to connect to remote podman machines...

[SECURITY] Fedora 36 Update: golang-github-cloudflare-0.21.0-3.fc36

A Go library for interacting with Cloudflare's API v4. This library allows you to: - Manage and automate changes to your DNS records within Cloudflare - Manage and automate changes to your zones domains on Cloudflare, includi ng adding new zones to your account - List and modify the status of WAF...

MAL-2022-1615 Malicious code in blockchain-wallet-v4-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a89d991ea9a446ae4d3d5807de7e61326972d6c0bd7e0ab2b217118d78c06be5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in discord.js-discord-selfbot-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8eed2fdf7ad75e62eebdf83520a0c2ba7528a1cf739ee597ddf57e5ab499e2b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-H2WQ-PRV9-2F56 Missing validation crashes `QuantizeAndDequantizeV4Grad`

Impact The implementation of tf.rawops.QuantizeAndDequantizeV4Grad does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf tf.rawops.QuantizeAndDequantizeV4Grad gradients=tf.constant1,...