CVE-2022-4066 davidmoreno onion Log response.c onion_response_flush allocation of resources

A vulnerability was found in davidmoreno onion. It has been rated as problematic. Affected by this issue is the function onionresponseflush of the file src/onion/response.c of the component Log Handler. The manipulation leads to allocation of resources. The name of the patch is...

Security Advisory for Ivanti Endpoint Manager Client-CVE-2022-27773

SECURITY ADVISORY 2022-11-16 Product Affected: Ivanti EPM Endpoint Manager PROBLEM: A vulnerability was recently discovered for Ivanti Endpoint Manager Client. Vulnerability InformationCVE| CVSS| Summary ---|---|--- CVE-2022-27773CVE | High - CVSS=7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | An issu...

DEBIAN-CVE-2022-3957

A vulnerability classified as problematic was found in GPAC. Affected by this vulnerability is the function svgparsepreserveaspectratio of the file scenegraph/svgattributes.c of the component SVG Parser. The manipulation leads to memory leak. The attack can be launched remotely. The name of the...

CVE-2022-41049 Windows Mark of the Web Security Feature Bypass Vulnerability

...

MGASA-2022-0409 Updated expat packages fix security vulnerability

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XMLExternalEntityParserCreate in out-of-memory situations. CVE-2022-43680...

CVE-2022-43237

Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via void putepelhvfallback in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted video file...

CVE-2022-43168

Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the reportsid parameter...

CVE-2022-24669 Anonymous users can register / de-register for configuration change notifications

It may be possible to gain some details of the deployment through a well-crafted attack. This may allow that data to be used to probe internal network services...

CVE-2022-34870 Apache Geode stored Cross-Site Scripting (XSS) via data injection vulnerability in Pulse web application

Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting XSS via data injection when using Pulse web application to view Region entries...

CVE-2021-26733 spx_restservice FirstReset_handler_func Broken Access Control

A broken access control vulnerability in the FirstResethandlerfunc function of spxrestservice allows an attacker to arbitrarily send reboot commands to the BMC, causing a Denial-of-Service DoS condition. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0...

CVE-2022-42938

A malicious crafted TGA file when consumed through DesignReview.exe application could lead to memory corruption vulnerability. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process...

OPENSUSE-SU-2022:10159-1 Security update for v4l2loopback

This update for v4l2loopback fixes the following issues: - Fix string format vulnerability boo1202156, CVE-2022-2652...

Abode Systems, Inc. iota All-In-One Security Kit XCMD setAlexa OS command injection vulnerability

Talos Vulnerability Report TALOS-2022-1558 Abode Systems, Inc. iota All-In-One Security Kit XCMD setAlexa OS command injection vulnerability October 20, 2022 CVE Number CVE-2022-33189 SUMMARY An OS command injection vulnerability exists in the XCMD setAlexa functionality of Abode Systems, Inc. io...

CVE-2022-41835 F5OS vulnerability CVE-2022-41835

In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.5.0, excessive file permissions in F5OS allows an authenticated local attacker to execute limited set of commands in a container and impact the F5OS controller...

SUSE-SU-2022:3613-1 Security update for postgresql-jdbc

This update for postgresql-jdbc fixes the following issues: - CVE-2022-31197: Fixed SQL injection vulnerability bsc1202170...

CVE-2022-41406

An arbitrary file upload vulnerability in the /admin/adminpic.php component of Church Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

SUSE-SU-2022:3466-1 Security update for expat

This update for expat fixes the following issues: - CVE-2022-40674: Fixed use-after-free in the doContent function in xmlparse.c bsc1203438...

SUSE SLES12 Security Update : libcaca (SUSE-SU-2022:3428-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3428-1 advisory. - CVE-2021-3410: Fixed overflow when multiplying large ints bsc1182731. Tenable has extracted the preceding description block directly from...

matanali.co.il Cross Site Scripting vulnerability OBB-2962833

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-32218

An information disclosure vulnerability exists in Rocket.Chat v5, v4.8.2 and v4.7.5 due to the actionLinkHandler method was found to allow Message ID Enumeration with Regex MongoDB queries...