CVE-2022-20868

A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco Secure Web Appliance could allow an authenticated, remote attacker to elevate privileges on an affected system. The attacker needs valid credentials to exploit thi...

CVE-2022-20868

CVE-2022-20868 affects Cisco Email Security Appliance (ESA), Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance. The root cause is a hardcoded value used to encrypt a token for certain API calls, enabling an authenticated, remote attacker with valid credentials to impersonate anot...

SUSE-SU-2022:3863-1 Security update for xorg-x11-server

This update for xorg-x11-server fixes the following issues: - CVE-2022-3550: Fixed out of bounds read/write in GetCountedString bsc1204412. - CVE-2022-3551: Fixed various leaks of the return value of GetComponentSpec bsc1204416...

The vulnerability of the njs_scope_valid_value function (njs_scope.h) in the NJS interpreter of the nginx server allows a attacker to cause a service failure.

The vulnerability of the njsscopevalidvalue function in the njs interpreter of the nginx server is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

Cisco Secure Web Appliance Privilege Escalation (cisco-sa-esasmawsa-vulns-YRuSW5mD)

According to its self-reported version, Cisco Secure Web Appliance is affected by a privilege escalation vulnerability thathat could allow an authenticated, remote attacker to elevate privileges on an affected system. This vulnerability is due to the use of a hard-coded value to encrypt a token...

GHSA-RCRX-FPJP-MFRW Unchecked Return Value to NULL Pointer Dereference in PDFDocumentHandler.cpp

Impact The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service DoS when supplied with a maliciously crafted PDF file to be appended to another. Patches It has been patched in 2.6.0 for muhammara and not at all for hummus Workarounds Do not process...

SUSE-SU-2022:3856-1 Security update for xorg-x11-server

This update for xorg-x11-server fixes the following issues: - CVE-2022-3550: Fixed out of bounds read/write in GetCountedString bsc1204412. - CVE-2022-3551: Fixed various leaks of the return value of GetComponentSpec bsc1204416...

SUSE-SU-2022:3850-1 Security update for xorg-x11-server

This update for xorg-x11-server fixes the following issues: - CVE-2022-3550: Fixed out of bounds read/write in GetCountedString bsc1204412. - CVE-2022-3551: Fixed various leaks of the return value of GetComponentSpec bsc1204416...

CVE-2022-39381 Unchecked Return Value to NULL Pointer Dereference in PDFDocumentHandler.cpp

Muhammara is a node module with c/cpp bindings to modify PDF with js for node or electron based/replacement on/of galkhana/hummusjs. The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service DoS when supplied with a maliciously crafted PDF file to be...

SUSE-SU-2022:3841-1 Security update for xorg-x11-server

This update for xorg-x11-server fixes the following issues: - CVE-2022-3550: Fixed out of bounds read/write in GetCountedString bsc1204412. - CVE-2022-3551: Fixed various leaks of the return value of GetComponentSpec bsc1204416...

SUSE-SU-2022:3840-1 Security update for xorg-x11-server

This update for xorg-x11-server fixes the following issues: - CVE-2022-3550: Fixed out of bounds read/write in GetCountedString bsc1204412. - CVE-2022-3551: Fixed various leaks of the return value of GetComponentSpec bsc1204416...

Sql injection

Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker with the role of student to perform a SQL injection on the 'searchvalue parameter in the...

The vulnerability of the setRepeaterSecurity function in D-Link DIR-816 A2 router software allows a hacker to execute arbitrary code.

The vulnerability of the setRepeaterSecurity function in D-Link DIR-816 A2 router software is related to the output of the operation outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using the pskValue parameter...

Forma Learning Management System SQL注入漏洞

Forma Learning Management System LMS is a Learning Management System LMS. Forma Learning Management System 3.1.0 and earlier versions suffer from a SQL injection vulnerability that can be exploited to perform SQL injection on the appLms/ajax.server.php?r=mycertificate/getMyCertificates function's...

Admin can set very low or very high value for setting fees & collateral factor in Market.sol resulting in value loss and/or DoS

Lines of code Vulnerability details Proof of Concept The contract’s admin has control to set values in setCollateralFactorBps, setLiquidationFactorBps, setReplenismentIncentiveBps, setLiquidationIncentiveBps, setLiquidationFeeBps. All of them have upper bounds, most of them have lower bounds, but...

Oracle.sol uses deprecated Chainlink method latestAnswer()

Lines of code Vulnerability details Proof of Concept Chainlink has market the latestAnswer method as deprecated for his price feeds, but the code is using it. Impact The latestAnswer method just returns the price and has no way to check if it is stale. If the project is using a stale price it can...

Rukovoditel 跨站脚本漏洞

Rukovoditel is a set of Web-based open source project management software from the Rukovoditel team. The software features project management, customer relationship management, and more. A cross-site scripting vulnerability exists in Rukovoditel version 3.2.1, which stems from the Value parameter...

CVE-2022-43001

D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the pskValue parameter in the setSecurity function...

PT-2022-5273 · D Link · D-Link Dir-816 A2

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 A2 version 1.10 B05 Description: The issue is related to a buffer overflow in the setRepeaterSecurity function of the D-Link DIR-816 A2 router's firmware. This can be exploited by a remote attacker using the pskValue parameter ...

CVE-2022-35876

Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial of service. An attacker can modify a...