5367 matches found
CVE-2023-49463
libheif v1.17.5 was discovered to contain a segmentation violation via the function findexiftag at /libheif/exif.cc...
CVE-2023-49462
libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc...
Debian dla-3676 : horizon-doc - security update
The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3676 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3676-1 [email protected] https://www.debian.org/lts/security/...
CVE-2023-49312
Precision Bridge PrecisionBridge.exe aka the thick client before 7.3.21 allows an integrity violation in which the same license key is used on multiple systems, via vectors involving a Process Hacker memory dump, error message inspection, and modification of a MAC address...
Design/Logic Flaw
Precision Bridge PrecisionBridge.exe aka the thick client before 7.3.21 allows an integrity violation in which the same license key is used on multiple systems, via vectors involving a Process Hacker memory dump, error message inspection, and modification of a MAC address...
CVE-2023-49312
Precision Bridge PrecisionBridge.exe aka the thick client before 7.3.21 allows an integrity violation in which the same license key is used on multiple systems, via vectors involving a Process Hacker memory dump, error message inspection, and modification of a MAC address...
CVE-2023-49312
CVE-2023-49312 affects Precision Bridge's Thick Client (PrecisionBridge.exe) prior to version 7.3.21. The root cause is an integrity violation that enables reuse of the same license key across multiple systems. Reported attack vectors involve a Process Hacker memory dump, inspecting error message...
Royalty Payment Invariant Violation
Lines of code Vulnerability details Impact The vulnerability in the payment mechanism of the smart contract significantly impacts the protocol's functionality. The root cause of the vulnerability is that, despite the README stating an invariant that "Payments can only be made when royalties are...
The vulnerability of the ares_inet_net_pton() function in the C-ares asynchronous DNS request library allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.
The vulnerability of the aresinetnetpton function in the C-ares asynchronous DNS request library is related to a violation of the buffer boundary. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...
Judge rules it’s fine for car makers to intercept your text messages
A federal judge has refused to bring back a class action lawsuit that alleged four car manufacturers had violated Washington state’s privacy laws by using vehicles’ on-board infotainment systems to record customers’ text messages and mobile phone call logs. The judge ruled that the practice doesn...
Rocky Linux 9 : freetype (RLSA-2022:8340)
The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:8340 advisory. - FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfntinitface. CVE-2022-2740...
Incident Response Plan: Frameworks and Steps
Gaining Insight: The Imperative for an Electronic Threat Handling Framework As we traverse further into the digital era, the threat of cyber encroachments elevates consistently. This looming risk is a reality for all, from emergent startups to well-established corporations, placing operations in...
MediaTek Chip Security Breach
MediaTek chips are a variety of chips from MediaTek, a Chinese company. A security vulnerability exists in the MediaTek chips due to a lack of boundary checking in the video module, which may result in out-of-bounds writes...
GHSA-6F58-J323-6472 pimcore/admin-ui-classic-bundle Unverified Password Change
Impact As old password can be set as new password , it is considered as password policy violation. Pimcore is not enforcing strict password policy which allow attacker to set old password as new password Proof of Concept 1. Go to Admin link 2. login and click on - "User | My Profile". 3. Go to...
U.S. Dept Of Defense: Elasticsearch is currently open without authentication on https://██████l
An Elasticsearch instance accessible at https://██████l was found to be open without authentication, exposing data to unauthorized access. The vulnerability allowed listing and extraction of sensitive data stored in the Elasticsearch indexes. To mitigate, authentication and authorization controls...
The vulnerability of the DCERPC protocol implementation in the software for managing virtual infrastructure VMware vCenter Server allows a perpetrator to execute arbitrary code.
The vulnerability of the DCERPC protocol implementation in the software for managing virtual infrastructure, VMware vCenter Server, is related to the possibility of writing data outside of the allowed range. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
CVE-2022-3248
A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions. This issue could allow an attacker to violate the boundaries, as permissions will not be applied...
CVE-2022-3248
A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions. This issue could allow an attacker to violate the boundaries, as permissions will not be applied...
Design/Logic Flaw
A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions. This issue could allow an attacker to violate the boundaries, as permissions will not be applied...
CVE-2022-3248 Openshift api admission checks does not enforce "custom-host" permissions
A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions. This issue could allow an attacker to violate the boundaries, as permissions will not be applied...