12759 matches found
CVE-2022-4883
A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH...
Syft log information leakage vulnerability
syft is a CLI tool and Go library for generating a software bill of materials SBOM from container images and filesystems. A log message disclosure vulnerability exists in syft, which stems from a password disclosure stored in the SYFTATTESTPASSWORD environment variable...
CVE-2022-4883
A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH...
D-Link var sys_Token Code Execution
The vulnerability of the var sysToken component in the D-Link DAP-2020 and DAP-1360 wireless access points is related to buffer overflow attacks. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
PT-2023-10821 · Unknown · Mobiledetect
Name of the Vulnerable Software and Affected Versions: MobileDetect version 2.8.31 Description: A problematic issue has been found in MobileDetect, affecting the initLayoutType function of the examples/session example.php file in the Example component. The manipulation of the argument $ SERVER'PH...
Upgraded Q -> 2 from #769 [1675429128999]
Judge has assessed an item in Issue 769 as 2 risk. The relevant finding follows: L-1 requireNextActiveMultisig always returns the 1st enabled Multisig Relevant code: As the name suggested, MultisigManager.requireNextActiveMultisig should return the next enabled Multisig. However, it actually alwa...
CKAN security vulnerabilities
CKAN is an open source Dms data management system. Used to power data centers and data portals. A security vulnerability exists in CKAN versions prior to 5.4.1, which stems from the fact that if a user does not set a custom value via an environment variable in the .env file, a key is shared betwe...
CVE-2022-32482
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable...
CVE-2022-32482
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable...
Input validation
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable...
CVE-2022-32482
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable...
CVE-2022-32482
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable...
CVE-2022-32482
CVE-2022-32482 : Dell BIOS contains an improper input validation vulnerability that allows a local authenticated attacker with admin privileges to potentially modify a UEFI variable. Affected component: Dell BIOS; root cause: input validation flaw. Exploitation details are not provided in the ava...
CVE-2022-32482: Improper Input Validation
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable...
PT-2023-13074 · Dell · Dell Bios
Name of the Vulnerable Software and Affected Versions: Dell BIOS affected versions not specified Description: The issue is related to an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability to modify a UEFI...
PT-2023-34878 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 3.0 through 5.4.229 Description: A null-deref issue was found in the gsmi get variable function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions 3.0 through...
In pkgconf through 1.9.3 variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example a .pc file containing a few hundred bytes can expand to one billion bytes.
...
CVE-2022-25936
Versions of the package servst before 2.0.3 are vulnerable to Directory Traversal due to improper sanitization of the filePath variable...
CVE-2022-25936
Summary: CVE-2022-25936 affects the servst package prior to 2.0.3, with a Directory Traversal flaw caused by improper sanitization of the filePath variable. The vulnerability can allow accessing files outside the intended directory. The connected sources identify 2.0.3 as the fixed version. No ex...