14017 matches found
PT-2024-25776 · Njwt · Njwt
Name of the Vulnerable Software and Affected Versions: njwt versions up to 0.4.0 Description: The issue is related to a prototype pollution in the Parser.prototype.parse method. This method is part of the njwt library, which suggests the pollution occurs during the parsing process, potentially...
njwt security vulnerabilities
njwt is the cleanest JSON Web Token JWT library for Node.js developers. A security vulnerability exists in njwt version v0.4.0 and earlier, which stems from the inclusion of a prototype contamination vulnerability found in the Parser.prototype.parse method...
Tor path lengths too short when "full Vanguards" configured
Description When building anonymizing circuits to or from an onion service with full vanguards enabled, the circuit manager code would build the circuits with one hop too few. Impact This makes users of this code more vulnerable to some kinds of traffic analysis when they run or visit onion...
CVE-2024-32655
Npgsql is the .NET data provider for PostgreSQL. The WriteBind method in src/Npgsql/Internal/NpgsqlConnector.FrontendMessages.cs uses int variables to store the message length and the sum of parameter lengths. Both variables overflow when the sum of parameter lengths becomes too large. This cause...
LLMjacking: An Attack Method for Stealing Cloud Credentials
...
Git security vulnerabilities
Git is a free, open source distributed version control system. A security vulnerability exists in Git, which stems from a special way to create a repository with submodules that can lead to arbitrary code execution when cloned...
TOTOLINK CPE CP450 security vulnerabilities
TOTOLINK CPE CP450 is an outdoor wireless client terminal device from China Gion Electronics TOTOLINK, which is mainly used to provide wireless broadband access services, especially for wireless network coverage in rural or remote areas. A security vulnerability exists in the TOTOLINK CPE CP450...
CVE-2024-3263
CVE-2024-3263 affects YMS VIS Pro due to improper system-credentials generation and weak password policy, enabling brute-force login attempts. Public details identify affected versions as VIS Pro 3.3.0.7). There is no explicit exploitation details or public in-the-wild exploit information provide...
RHEL 7 : python-django (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - python-django: Potential regular expression denial of service vulnerability in EmailValidator/URLValidato...
ibus-anthy update
An update is available for ibus-anthy. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The ibus-anthy packages contain the Anthy engine for the IBus platform. Th...
New TunnelVision Attack Allows Hijacking of VPN Traffic via DHCP Manipulation
Researchers have detailed a Virtual Private Network VPN bypass technique dubbed TunnelVision that allows threat actors to snoop on victim's network traffic by just being on the same local network. The "decloaking" method has been assigned the CVE identifier CVE-2024-3661 CVSS score: 7.6. It impac...
Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service
Important: Exploiting this vulnerability requires the attacker to have access to your Frigate instance, which means they could also just delete all of your recordings or perform any other action. If you have configured authentication in front of Frigate via a reverse proxy, then this vulnerabilit...
PT-2024-3776 · Npgsql · Npgsql
Name of the Vulnerable Software and Affected Versions: Npgsql versions prior to 4.0.14 Npgsql versions prior to 4.1.13 Npgsql versions prior to 5.0.18 Npgsql versions prior to 6.0.11 Npgsql versions prior to 7.0.7 Npgsql versions prior to 8.0.3 Description: The WriteBind method in...
CVE-2024-1930
No Limit on Number of Open Sessions / Bad Session Close Behaviour in dnf5daemon-server before 5.1.17 allows a malicious user to impact Availability via No Limit on Number of Open Sessions. There is no limit on how many sessions D-Bus clients may create using the opensession D-Bus method. For each...
CVE-2024-1930
No Limit on Number of Open Sessions / Bad Session Close Behaviour in dnf5daemon-server before 5.1.17 allows a malicious user to impact Availability via No Limit on Number of Open Sessions. There is no limit on how many sessions D-Bus clients may create using the opensession D-Bus method. For each...
CVE-2024-1930 No Limit on Number of Open Sessions / Bad Session Close Behaviour
No Limit on Number of Open Sessions / Bad Session Close Behaviour in dnf5daemon-server before 5.1.17 allows a malicious user to impact Availability via No Limit on Number of Open Sessions. There is no limit on how many sessions D-Bus clients may create using the opensession D-Bus method. For each...
CVE-2024-1930
The CVE-2024-1930 issue affects dnf5daemon-server and is triggered by an unlimited number of sessions created via the D-Bus open_session() method. Each session spawns a thread, consuming memory (hundreds of MB per session), which can exhaust resources and render the service unable to accept new c...
CVE-2021-34970
Foxit PDF Reader print Method Use of Externally-Controlled Format String Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in...
CVE-2021-34975
CVE-2021-34975 : Foxit PDF Reader contains a use-after-free in the transitionToState method, caused by failing to validate an object’s existence before use. This allows an attacker to execute arbitrary code in the context of the current process, with user interaction required (target must visit a...
CVE-2021-34970
CVE-2021-34970 (Foxit PDF Reader / PhantomPDF) is a vulnerability where the print method mishandles a user-supplied string used as a format specifier, due to improper validation. This leads to information disclosure on affected Foxit PDF Reader/PhantomPDF installations and, per sources, can be le...