🚨 CVE-2022-41670
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load malicious DLL which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).
🎖@cveNotify
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load malicious DLL which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).
🎖@cveNotify
🚨 CVE-2022-41671
A CWE-89: Improper Neutralization of Special Elements used in SQL Command (‘SQL Injection’) vulnerability exists that allows adversaries with local user privileges to craft a malicious SQL query and execute as part of project migration which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).
🎖@cveNotify
A CWE-89: Improper Neutralization of Special Elements used in SQL Command (‘SQL Injection’) vulnerability exists that allows adversaries with local user privileges to craft a malicious SQL query and execute as part of project migration which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).
🎖@cveNotify
🚨 CVE-2022-44054
The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-utility package. The affected version of d8s-htm is 0.1.0.
🎖@cveNotify
The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-utility package. The affected version of d8s-htm is 0.1.0.
🎖@cveNotify
PyPI
democritus-utility
Democritus functions for working with utility functions.
🚨 CVE-2022-44051
The d8s-stats for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-math package. The affected version of d8s-htm is 0.1.0.
🎖@cveNotify
The d8s-stats for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-math package. The affected version of d8s-htm is 0.1.0.
🎖@cveNotify
🚨 CVE-2022-44053
The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-user-agents package. The affected version of d8s-htm is 0.1.0.
🎖@cveNotify
The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-user-agents package. The affected version of d8s-htm is 0.1.0.
🎖@cveNotify
PyPI
d8s-networking
Democritus functions for working with network requests.
🚨 CVE-2022-0554
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.
🎖@cveNotify
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.
🎖@cveNotify
GitHub
patch 8.2.4327: may end up with no current buffer · vim/vim@e3537ae
Problem: May end up with no current buffer.
Solution: When deleting the current buffer to not pick a quickfix buffer as
the new current buffer.
Solution: When deleting the current buffer to not pick a quickfix buffer as
the new current buffer.
🚨 CVE-2022-0685
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4418.
🎖@cveNotify
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4418.
🎖@cveNotify
🚨 CVE-2022-0714
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436.
🎖@cveNotify
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436.
🎖@cveNotify
GitHub
patch 8.2.4436: crash with weird 'vartabstop' value · vim/vim@4e889f9
Problem: Crash with weird 'vartabstop' value.
Solution: Check for running into the end of the line.
Solution: Check for running into the end of the line.
🚨 CVE-2022-0729
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440.
🎖@cveNotify
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440.
🎖@cveNotify
huntr.dev
Use of Out-of-range Pointer Offset in vim
24.63K developers have been protected by securing vim. Read this report, and explore others to learn how you can also protect the world by earning cash and CVEs.
🚨 CVE-2022-1154
Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646.
🎖@cveNotify
Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646.
🎖@cveNotify
huntr.dev
Use After Free in vim
24.63K developers have been protected by securing vim. Read this report, and explore others to learn how you can also protect the world by earning cash and CVEs.
🚨 CVE-2022-0943
Heap-based Buffer Overflow occurs in vim in GitHub repository vim/vim prior to 8.2.4563.
🎖@cveNotify
Heap-based Buffer Overflow occurs in vim in GitHub repository vim/vim prior to 8.2.4563.
🎖@cveNotify
GitHub
patch 8.2.4563: "z=" in Visual mode may go beyond the end of the line · vim/vim@5c68617
Problem: "z=" in Visual mode may go beyond the end of the line.
Solution: Adjust "badlen".
Solution: Adjust "badlen".
🚨 CVE-2022-1616
Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution
🎖@cveNotify
Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution
🎖@cveNotify
GitHub
patch 8.2.4895: buffer overflow with invalid command with composing c… · vim/vim@d889344
…hars
Problem: Buffer overflow with invalid command with composing chars.
Solution: Check that the whole character fits in the buffer.
Problem: Buffer overflow with invalid command with composing chars.
Solution: Check that the whole character fits in the buffer.
🚨 CVE-2022-1720
Buffer Over-read in function grab_file_name in GitHub repository vim/vim prior to 8.2.4956. This vulnerability is capable of crashing the software, memory modification, and possible remote execution.
🎖@cveNotify
Buffer Over-read in function grab_file_name in GitHub repository vim/vim prior to 8.2.4956. This vulnerability is capable of crashing the software, memory modification, and possible remote execution.
🎖@cveNotify
GitHub
patch 8.2.4956: reading past end of line with "gf" in Visual block mode · vim/vim@395bd1f
Problem: Reading past end of line with "gf" in Visual block mode.
Solution: Do not include the NUL in the length.
Solution: Do not include the NUL in the length.
🚨 CVE-2022-2598
Undefined Behavior for Input to API in GitHub repository vim/vim prior to 9.0.0100.
🎖@cveNotify
Undefined Behavior for Input to API in GitHub repository vim/vim prior to 9.0.0100.
🎖@cveNotify
GitHub
patch 9.0.0101: invalid memory access in diff mode with "dp" and undo · vim/vim@4e677b9
Problem: Invalid memory access in diff mode with "dp" and undo.
Solution: Make sure the line number does not go below one.
Solution: Make sure the line number does not go below one.