CVE-2024-29510

A flaw in Ghostscript has been identified where the uniprint device allows users to pass various string fragments as device options. These strings, particularly upWriteComponentCommands and upYMoveCommand, are treated as format strings for gpfprintf and gssnprintf. This lack of restriction permit...

Debian dsa-5692 : ghostscript - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5692 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5692-1 [email protected]...

[SECURITY] [DSA 5692-1] ghostscript security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5692-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 15, 2024 https://www.debian.org/security/faq -...

CVE-2024-29510

Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device...

Ghostscript Command Execution via Format String

This module exploits a format string vulnerability in Ghostscript versions before 10.03.1 to achieve a SAFER sandbox bypass and execute arbitrary commands. This vulnerability is reachable via libraries such as ImageMagick. This exploit only works against Ghostscript versions 10.03.0 and 10.01.2...

Ubuntu: Security Advisory (USN-6553-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-29510

Improper buffer restrictions in some IntelR Server Board M10JNP2SB BIOS firmware before version 7.219 may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2022-29510

CVE-2022-29510 affects Intel Server Board M10JNP2SB BIOS firmware prior to 7.219. The issue is improper buffer restrictions that may allow a locally privileged user to escalate privileges. Impact is local, with high confidentiality/integrity/availability implications per the CVE. Intel’s advisory...

CVE-2023-29510 Code injection via unescaped translations in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In XWiki, every user can add translations that are only applied to the current user. This also allows overriding existing translations. Such translations are often included in privileged...

CVE-2023-29510

CVE-2023-29510 is a code injection/remote execution vulnerability in XWiki Platform caused by unescaped user-scoped translations that can be injected in privileged contexts. The issue allows remote code execution for users with edit access on at least one document (potentially their own profile)....

CVE-2023-29510

creationtimestamp| type| source ---|---|--- 2023-04-18 10:13:20+00:00| published-proof-of-concept| https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4v38-964c-xjmw 2023-04-19 07:43:16+00:00| seen| https://t.me/cibsecurity/62433...

SUSE CVE-2020-29510

The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications...

Security Bulletin: IBM App Connect Enterprise Certified Container operator may be affected by CVE-2020-29510

Summary The operator for IBM App Connect Enterprise Certified Container may be affected by CVE-2020-29510 if the operator is made to process XML Vulnerability Details CVEID: CVE-2020-29510 DESCRIPTION: Golang Go could allow a remote attacker to bypass security restrictions, caused by the failure ...

Photon OS 3.0: Go PHSA-2021-3.0-0248

An update of the go package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0248. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Fedora: Security Advisory for python-pydantic (FEDORA-2021-4d3de3183f)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for python-pydantic (FEDORA-2021-f8bb3ba3ec)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2021-29510

Pydantic is a data validation and settings management using Python type hinting. In affected versions passing either 'infinity', 'inf' or float'inf' or their negatives to datetime or date fields causes validation to run forever with 100% CPU usage on one CPU. Pydantic has been patched with fixes...

CVE-2021-29510 Use of "infinity" as an input to datetime and date fields causes infinite loop in pydantic

Pydantic is a data validation and settings management using Python type hinting. In affected versions passing either 'infinity', 'inf' or float'inf' or their negatives to datetime or date fields causes validation to run forever with 100% CPU usage on one CPU. Pydantic has been patched with fixes...

CVE-2021-29510

CVE-2021-29510 affects the Python package pydantic prior to version 1.8.2 (also listed as affected in 1.7.x and 1.6.x). The issue occurs when passing invalid date/datetime values such as 'infinity', 'inf', or float('inf') (and their negatives) to date or datetime fields, causing validation to run...

Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2021-1678)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...