388889 matches found
DEBIAN-CVE-2026-88842
A flaw was found in BusyBox dpkg. The writestatusfile function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited...
CVE-2026-88842
A flaw was found in BusyBox dpkg. The writestatusfile function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited...
DEBIAN-CVE-2026-101338
When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written out by NSD itself, such as for zones for which t...
CVE-2026-101338
When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written out by NSD itself, such as for zones for which t...
CVE-2026-101337
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD...
CVE-2026-101341 Stack overwrite from specially formatted TXT-DATA RDATA field
Tokens of text in RDATA of for example TXT records under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which ar...
CVE-2026-101341
The NSD name server is vulnerable to an out-of-bound stack write due to insufficient bounds checking on text tokens in RDATA (e.g., TXT records ) under 32 bytes. This flaw allows for arbitrary sized writes , including the potential overwrite of a callback function pointer immediately following a ...
CVE-2026-101341 Stack overwrite from specially formatted TXT-DATA RDATA field
Tokens of text in RDATA of for example TXT records under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which ar...
CVE-2026-101338
The NSD name server is vulnerable to a stack-based buffer overflow (CWE-121) when processing specially crafted SVCB or HTTPS resource records (RR ). If the wire format RDATA is filled to its limit, an additional ECH parameter can overwrite the stack. Furthermore, if the limit is exceeded, the bas...
EUVD-2026-100982
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD...
CVE-2026-101337
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD...
CVE-2026-101337
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD...
CLSA-2026-1791974541 TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 3.4.13-tuxcare.2...
CLSA-2026-1791973815 TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 2.7.18-tuxcare.10...
CVE-2026-103308 Visma Pay for WooCommerce < 1.2.2 - Unauthenticated Payment Bypass and Order Data Disclosure via Gateway Return Endpoint
The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret that is empty on a store which has not entered its credentials, allowing unauthenticated attackers to mark arbitrary orders as paid and to...
CVE-2026-73793
HPE NonStop Middleware software has secret key handling and data deserialization vulnerability...
CVE-2026-88842
A flaw was found in BusyBox dpkg. The writestatusfile function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited...
CVE-2026-88842 Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption
A flaw was found in BusyBox dpkg. The writestatusfile function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited...
EUVD-2026-100957
A flaw was found in BusyBox dpkg. The writestatusfile function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited...
Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Struts
Summary Multiple vulnerabilities were addressed in IBM Library Support for Struts 1.0 Vulnerability Details CVEID:CVE-2005-3745 DESCRIPTION: Cross-site scripting XSS vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML vi...