CVE-2023-5950 Rapid7 Velociraptor Reflected XSS

This advisory covers a specific issue identified in Velociraptor and disclosed by a security code review. We want to thank Mathias Kujala for working with the Velociraptor team to identify and rectify this issue. It has been fixed as of Version 0.7.0-4, released November 6, 2023. CVSS · HIGH ·...

CVE-2023-5950 Rapid7 Velociraptor Reflected XSS

This advisory covers a specific issue identified in Velociraptor and disclosed by a security code review. We want to thank Mathias Kujala for working with the Velociraptor team to identify and rectify this issue. It has been fixed as of Version 0.7.0-4, released November 6, 2023. CVSS · HIGH ·...

CVE-2023-5950

Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. This vulnerability allows attackers to inject JS into the error path, potentially leading to unauthorized execution of scripts within a user's web browser. This vulnerability is fixed...

Cross site scripting

Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. This vulnerability allows attackers to inject JS into the error path, potentially leading to unauthorized execution of scripts within a user's web browser. This vulnerability is fixed...

CVE-2023-5950 Rapid7 Velociraptor Reflected XSS

Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. This vulnerability allows attackers to inject JS into the error path, potentially leading to unauthorized execution of scripts within a user's web browser. This vulnerability is fixed...

Velociraptor Cross-Site Scripting Vulnerability

Velociraptor is a Velocidex open source tool for collecting host-based state information using Velociraptor Query Language VQL queries. A security vulnerability exists in Velociraptor versions prior to 0.7.0-4 suffer that stems from the presence of a Reflective Cross-Site Scripting XSS...

CVE-2023-46139

KernelSU is a Kernel based root solution for Android. Starting in version 0.6.1 and prior to version 0.7.0, if a KernelSU installed device is infected with a malware whose app signing block specially constructed, it can take over root privileges on the device. The vulnerable verification logic...

WordPress plugin PixFields Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

WordPress Plugin Charts Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Ffmpeg Code Execution Vulnerability

FFmpeg is a complete solution for recording, converting and streaming audio and video from the FFmpeg team. A code execution vulnerability exists in FFmpeg 0.7.0 and earlier versions, which stems from a failure to properly filter special elements of the constructor snippet in the component...

GHSA-2JX3-FX5F-R2C6 FFmpeg discovered to contain a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.<constructor>

Withdrawn This advisory has been withdrawn because it has been found to be disputed. Please see the issue here for more information. Original Despcription FFmpeg 0.7.0 and below was discovered to contain a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.. This vulnerability ...

CVE-2023-39018

FFmpeg 0.7.0 and below was discovered to contain a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.. This vulnerability is exploited via passing an unchecked argument. NOTE: this is disputed by multiple third parties because there are no realistic use cases in which...

Code injection

FFmpeg 0.7.0 and below was discovered to contain a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.. This vulnerability is exploited via passing an unchecked argument. NOTE: this is disputed by multiple third parties because there are no realistic use cases in which...

PT-2023-26740 · FFmpeg · Ffmpeg

Name of the Vulnerable Software and Affected Versions: FFmpeg versions 0.7.0 and below Description: A code injection issue was discovered in the net.bramp.ffmpeg.FFmpeg. component. This issue is exploited by passing an unchecked argument. However, it's noted that there are no realistic use cases...

CVE-2023-3072

HashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11...

HashiCorp Nomad 安全漏洞

HashiCorp Nomad is a simple and flexible scheduler and orchestrator from HashiCorp USA. for managing containerized and non-containerized applications at scale, both locally and in the cloud. A security vulnerability exists in HashiCorp Nomad and Nomad Enterpris that stems from the use of unlabele...

CVE-2023-37365

Hnswlib 0.7.0 has a double free in initindex when the M argument is a large integer...

Double free

Hnswlib 0.7.0 has a double free in initindex when the M argument is a large integer...

CVE-2023-37365

CVE-2023-37365 affects hnswlib 0.7.0 and involves a double free in the function init_index when the M argument is a large integer. The available connected sources consistently state this as a double-free vulnerability in hnswlib’s init_index, with no detailed vendor/patch/version information prov...

PT-2023-25934

Name of the Vulnerable Software and Affected Versions Hnswlib version 0.7.0 Description The issue is related to a double free in the init index function when the M argument is a large integer. This occurs in the Hnswlib library. Recommendations For Hnswlib version 0.7.0, consider restricting the...