CVE-2022-4883

A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH...

CVE-2022-4883

CVE-2022-4883 concerns the libXpm library. When processing files with .Z or .gz extensions, libXpm may invoke external programs to compress/uncompress, using PATH to locate these helpers. This behavior allows a local attacker to cause arbitrary program execution by manipulating PATH. Reported acr...

D-Link var sys_Token Code Execution

The vulnerability of the var sysToken component in the D-Link DAP-2020 and DAP-1360 wireless access points is related to buffer overflow attacks. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

PT-2023-10821 · Unknown · Mobiledetect

Name of the Vulnerable Software and Affected Versions: MobileDetect version 2.8.31 Description: A problematic issue has been found in MobileDetect, affecting the initLayoutType function of the examples/session example.php file in the Example component. The manipulation of the argument $ SERVER'PH...

Upgraded Q -> 2 from #769 [1675429128999]

Judge has assessed an item in Issue 769 as 2 risk. The relevant finding follows: L-1 requireNextActiveMultisig always returns the 1st enabled Multisig Relevant code: As the name suggested, MultisigManager.requireNextActiveMultisig should return the next enabled Multisig. However, it actually alwa...

CKAN security vulnerabilities

CKAN is an open source Dms data management system. Used to power data centers and data portals. A security vulnerability exists in CKAN versions prior to 5.4.1, which stems from the fact that if a user does not set a custom value via an environment variable in the .env file, a key is shared betwe...

CVE-2022-32482

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable...

CVE-2022-32482

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable...

Input validation

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable...

CVE-2022-32482

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable...

CVE-2022-32482

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable...

CVE-2022-32482

CVE-2022-32482 : Dell BIOS contains an improper input validation vulnerability that allows a local authenticated attacker with admin privileges to potentially modify a UEFI variable. Affected component: Dell BIOS; root cause: input validation flaw. Exploitation details are not provided in the ava...

PT-2023-13074 · Dell · Dell Bios

Name of the Vulnerable Software and Affected Versions: Dell BIOS affected versions not specified Description: The issue is related to an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability to modify a UEFI...

CVE-2022-32482: Improper Input Validation

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable...

PT-2023-34878 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 3.0 through 5.4.229 Description: A null-deref issue was found in the gsmi get variable function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions 3.0 through...

In pkgconf through 1.9.3 variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example a .pc file containing a few hundred bytes can expand to one billion bytes.

...

CVE-2022-25936

Versions of the package servst before 2.0.3 are vulnerable to Directory Traversal due to improper sanitization of the filePath variable...

CVE-2022-25936

Versions of the package servst before 2.0.3 are vulnerable to Directory Traversal due to improper sanitization of the filePath variable...

CVE-2022-25936

Summary: CVE-2022-25936 affects the servst package prior to 2.0.3, with a Directory Traversal flaw caused by improper sanitization of the filePath variable. The vulnerability can allow accessing files outside the intended directory. The connected sources identify 2.0.3 as the fixed version. No ex...

PT-2023-15544 · Taocms · Taocms

Name of the Vulnerable Software and Affected Versions: taocms version 3.0.2 Description: The issue allows attackers to execute arbitrary code via a crafted PHP file. This is exploited through manipulation of the upext variable at the "/include/Model/Upload.php" endpoint. Recommendations: For taoc...