Full List

Search

Recent Vulnerabilities

• CVE-2021-42782 • published on April 18, 2022 Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library.
• CVE-2022-24859 • published on April 18, 2022 PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the code attempts to get the content stream. The reason is that the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually checks if the stream has already ended. This issue has been resolved in version `1.27.5`. Users unable to upgrade should validate and PDFs prior to iterating over their content stream.
• CVE-2022-29458 • published on April 18, 2022 ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.
• CVE-2022-29464 • published on April 18, 2022 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.
• CVE-2021-3652 • published on April 18, 2022 A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
• CVE-2021-42779 • published on April 18, 2022 A heap use after free issue was found in Opensc before version 0.22.0 in sc_file_valid.
• CVE-2021-42780 • published on April 18, 2022 A use after return issue was found in Opensc before version 0.22.0 in insert_pin function that could potentially crash programs using the library.
• CVE-2021-42781 • published on April 18, 2022 Heap buffer overflow issues were found in Opensc before version 0.22.0 in pkcs15-oberthur.c that could potentially crash programs using the library.
• CVE-2021-42782 • published on April 18, 2022 Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library.
• CVE-2022-24859 • published on April 18, 2022 PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the code attempts to get the content stream. The reason is that the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually checks if the stream has already ended. This issue has been resolved in version `1.27.5`. Users unable to upgrade should validate and PDFs prior to iterating over their content stream.
• CVE-2022-29458 • published on April 18, 2022 ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.
• CVE-2022-29464 • published on April 18, 2022 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.
• CVE-2021-3652 • published on April 18, 2022 A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
• CVE-2021-42780 • published on April 18, 2022 A use after return issue was found in Opensc before version 0.22.0 in insert_pin function that could potentially crash programs using the library.
• CVE-2021-42781 • published on April 18, 2022 Heap buffer overflow issues were found in Opensc before version 0.22.0 in pkcs15-oberthur.c that could potentially crash programs using the library.
• CVE-2021-42779 • published on April 18, 2022 A heap use after free issue was found in Opensc before version 0.22.0 in sc_file_valid.
• CVE-2021-42782 • published on April 18, 2022 Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library.
• CVE-2022-29458 • published on April 18, 2022 ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.
• CVE-2022-1383 • published on April 17, 2022 Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.8. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
• CVE-2022-1383 • published on April 17, 2022 Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.8. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.