‼ CVE-2022-36713 ‼
📖 Read
via "National Vulnerability Database".
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Section parameter at /librarian/lab.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36714 ‼
📖 Read
via "National Vulnerability Database".
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Section parameter at /staff/lab.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24106 ‼
📖 Read
via "National Vulnerability Database".
In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the image, leading to an unknown integer-related vulnerability in Stream.cc.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38784 ‼
📖 Read
via "National Vulnerability Database".
Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2022-38171 in Xpdf.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24107 ‼
📖 Read
via "National Vulnerability Database".
Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39028 ‼
📖 Read
via "National Vulnerability Database".
telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but the telnet service would remain available through inetd. However, if the telnetd application has many crashes within a short time interval, the telnet service would become unavailable after inetd logs a "telnet/tcp server failing (looping), service terminated" error. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26527 ‼
📖 Read
via "National Vulnerability Database".
Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for the size of segmented packets’ reference parameter. An unauthenticated attacker in the adjacent network can exploit this vulnerability to cause buffer overflow and disrupt service.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25635 ‼
📖 Read
via "National Vulnerability Database".
Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for broadcast network packet length. An unauthenticated attacker in the adjacent network can exploit this vulnerability to disrupt service.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3022 ‼
📖 Read
via "National Vulnerability Database".
Stack-based Buffer Overflow in GitHub repository arnoldaldrin/binaries prior to 1.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26529 ‼
📖 Read
via "National Vulnerability Database".
Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for segmented packets’ link parameter. An unauthenticated attacker in the adjacent network can exploit this vulnerability to cause buffer overflow and disrupt service.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46837 ‼
📖 Read
via "National Vulnerability Database".
res_pjsip_t38 in Sangoma Asterisk 16.x before 16.16.2, 17.x before 17.9.3, and 18.x before 18.2.2, and Certified Asterisk before 16.8-cert7, allows an attacker to trigger a crash by sending an m=image line and zero port in a response to a T.38 re-invite initiated by Asterisk. This is a re-occurrence of the CVE-2019-15297 symptoms but not for exactly the same reason. The crash occurs because there is an append operation relative to the active topology, but this should instead be a replace operation.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25646 ‼
📖 Read
via "National Vulnerability Database".
All versions of package x-data-spreadsheet are vulnerable to Cross-site Scripting (XSS) due to missing sanitization of values inserted into the cells.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38116 ‼
📖 Read
via "National Vulnerability Database".
Le-yan Personnel and Salary Management System has hard-coded database account and password within the website source code. An unauthenticated remote attacker can access, modify system data or disrupt service.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-25887 ‼
📖 Read
via "National Vulnerability Database".
The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-2330 ‼
📖 Read
via "National Vulnerability Database".
Improper Restriction of XML External Entity Reference vulnerability in DLP Endpoint for Windows prior to 11.9.100 and 11.6.600 allows a remote attacker to cause the DLP Agent to access a local service that the attacker wouldn't usually have access to via a carefully constructed XML file, which the DLP Agent doesn't parse correctly.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38118 ‼
📖 Read
via "National Vulnerability Database".
OAKlouds Portal website’s Meeting Room has insufficient validation for user input. A remote attacker with general user privilege can perform SQL-injection to access, modify, delete database, perform system operations and disrupt service.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25857 ‼
📖 Read
via "National Vulnerability Database".
The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26528 ‼
📖 Read
via "National Vulnerability Database".
Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for the length of segmented packets’ shift parameter. An unauthenticated attacker in the adjacent network can exploit this vulnerability to cause buffer overflow and disrupt service.📖 Read
via "National Vulnerability Database".
🗓️ Graph-based JavaScript bug scanner discovers more than 100 zero-day vulnerabilities in Node.js libraries 🗓️
📖 Read
via "The Daily Swig".
ODGen tool was presented at this year’s Usenix Security Symposium📖 Read
via "The Daily Swig".
portswigger.net
Web Application Security, Testing, & Scanning - PortSwigger
PortSwigger offers tools for web application security, testing, & scanning. Choose from a range of security tools, & identify the very latest vulnerabilities.
⚠ LastPass source code breach – do we still recommend password managers? ⚠
📖 Read
via "Naked Security".
What does the recent LastPass breach mean for password managers? Just a bump in the road, or a reason to ditch them entirely?📖 Read
via "Naked Security".
Naked Security
LastPass source code breach – do we still recommend password managers?
What does the recent LastPass breach mean for password managers? Just a bump in the road, or a reason to ditch them entirely?
👍1
‼ CVE-2022-3063 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Generic in GitHub repository nuxt/framework prior to -.📖 Read
via "National Vulnerability Database".