‼ CVE-2020-21161 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability in Ruckus Wireless ZoneDirector 9.8.3.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2017-20102 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in Album Lock 4.0 and classified as critical. Affected by this issue is some unknown functionality of the file /getImage. The manipulation of the argument filePaht leads to path traversal. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.📖 Read
via "National Vulnerability Database".
🗓️ Researchers crack MEGA’s ‘privacy by design’ storage, encryption 🗓️
📖 Read
via "The Daily Swig".
ETH Zurich finds flaws in the firm’s cryptographic infrastructure📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Researchers crack MEGA’s ‘privacy by design’ storage, encryption
ETH Zurich finds flaws in the firm’s cryptographic infrastructure
⚠ Harmony blockchain loses nearly $100M due to hacked private keys ⚠
📖 Read
via "Naked Security".
The crooks needed at least two private keys, each stored in two parts... but they got them anyway.📖 Read
via "Naked Security".
Naked Security
Harmony blockchain loses nearly $100M due to hacked private keys
The crooks needed at least two private keys, each stored in two parts… but they got them anyway.
‼ CVE-2022-2140 ‼
📖 Read
via "National Vulnerability Database".
Elcomplus SmartICS v2.3.4.0 does not neutralize user-controllable input, which allows an authenticated user to inject arbitrary code into specific parameters.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33650 ‼
📖 Read
via "National Vulnerability Database".
When performing the inference shape operation of the SparseToDense operator, if the number of inputs is less than three, it will access data outside of bounds of inputs which allocated from heap buffers.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2106 ‼
📖 Read
via "National Vulnerability Database".
Elcomplus SmartICS v2.3.4.0 does not validate the filenames sufficiently, which enables authenticated administrator-level users to perform path traversal attacks and specify arbitrary files.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33651 ‼
📖 Read
via "National Vulnerability Database".
When performing the analytical operation of the DepthwiseConv2D operator, if the attribute depth_multiplier is 0, it will cause a division by 0 exception.📖 Read
via "National Vulnerability Database".
‼ CVE-2013-2084 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-2069. Reason: This candidate is a reservation duplicate of CVE-2013-2069. Notes: All CVE users should reference CVE-2013-2069 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2088 ‼
📖 Read
via "National Vulnerability Database".
An authenticated user with admin privileges may be able to terminate any process on the system running Elcomplus SmartICS v2.3.4.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33654 ‼
📖 Read
via "National Vulnerability Database".
When performing the initialization operation of the Split operator, if a dimension in the input shape is 0, it will cause a division by 0 exception.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33653 ‼
📖 Read
via "National Vulnerability Database".
When performing the derivation shape operation of the SpaceToBatch operator, if there is a value of 0 in the parameter block_shape element, it will cause a division by 0 exception.📖 Read
via "National Vulnerability Database".
‼ CVE-2013-2216 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33648 ‼
📖 Read
via "National Vulnerability Database".
When performing the inference shape operation of Affine, Concat, MatMul, ArgMinMax, EmbeddingLookup, and Gather operators, if the input shape size is 0, it will access data outside of bounds of shape which allocated from heap buffers.📖 Read
via "National Vulnerability Database".
‼ CVE-2013-2180 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2210 ‼
📖 Read
via "National Vulnerability Database".
Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33649 ‼
📖 Read
via "National Vulnerability Database".
When performing the inference shape operation of the Transpose operator, if the value in the perm element is greater than or equal to the size of the input_shape, it will access data outside of bounds of input_shape which allocated from heap buffers.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33652 ‼
📖 Read
via "National Vulnerability Database".
When the Reduce operator run operation is executed, if there is a value of 0 in the parameter axis_sizes element, it will cause a division by 0 exception.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33647 ‼
📖 Read
via "National Vulnerability Database".
When performing the inference shape operation of the Tile operator, if the input data type is not int or int32, it will access data outside of bounds of heap allocated buffers.📖 Read
via "National Vulnerability Database".
🕴 Shadow IT Spurs 1 in 3 Cyberattacks 🕴
📖 Read
via "Dark Reading".
Cerby platform emerges from stealth mode to let users automate security for applications outside of the standard IT purview.📖 Read
via "Dark Reading".
Dark Reading
Shadow IT Spurs 1 in 3 Cyberattacks
Cerby platform emerges from stealth mode to let users automate security for applications outside of the standard IT purview.
‼ CVE-2022-31034 ‼
📖 Read
via "National Vulnerability Database".
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v0.11.0 are vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or UI. The vulnerabilities are due to the use of insufficiently random values in parameters in Oauth2/OIDC login flows. In each case, using a relatively-predictable (time-based) seed in a non-cryptographically-secure pseudo-random number generator made the parameter less random than required by the relevant spec or by general best practices. In some cases, using too short a value made the entropy even less sufficient. The attacks on login flows which are meant to be mitigated by these parameters are difficult to accomplish but can have a high impact potentially granting an attacker admin access to Argo CD. Patches for this vulnerability has been released in the following Argo CD versions: v2.4.1, v2.3.5, v2.2.10 and v2.1.16. There are no known workarounds for this vulnerability.📖 Read
via "National Vulnerability Database".