65 matches found
CVE-2024-6238 pgAdmin 4 Installation Directory permission issue
pgAdmin = 8.8 has an installation Directory permission issue. Because of this issue, attackers can gain unauthorised access to the installation directory on the Debian or RHEL 8 platforms...
CVE-2023-6238
A buffer overflow vulnerability was found in the NVM Express NVMe driver in the Linux kernel. Only privileged user could specify a small meta buffer and let the device perform larger Direct Memory Access DMA into the same buffer, overwriting unrelated kernel memory, causing random kernel crashes...
CVE-2023-6238 Kernel: nvme: memory corruption via unprivileged user passthrough
A buffer overflow vulnerability was found in the NVM Express NVMe driver in the Linux kernel. Only privileged user could specify a small meta buffer and let the device perform larger Direct Memory Access DMA into the same buffer, overwriting unrelated kernel memory, causing random kernel crashes...
CVE-2023-6238
CVE-2023-6238 affects the Linux kernel NVMe driver. A buffer overflow allows a privileged user to provide a small meta buffer and trigger a larger DMA into that same buffer, overwriting unrelated kernel memory and causing random kernel crashes/memory corruption. The vulnerability is locally explo...
SUSE CVE-2016-6238
The writeujpg function in lepton/jpgcoder.cc in Dropbox lepton 1.0 allows remote attackers to cause denial of service out-of-bounds read via a crafted jpeg file...
CVE-2019-6238
creationtimestamp| type| source ---|---|--- 2020-10-27 23:36:43+00:00| seen| https://t.me/cibsecurity/15632 2022-12-13 08:55:06+00:00| published-proof-of-concept| https://t.me/thebugbountyhunter/6802 2026-09-01 20:01:14+00:00| seen| https://t.me/hackingAttack/80165 2026-09-01 20:01:14+00:00| seen...
CVE-2019-6238
CVE-2019-6238 involves a validation issue in the handling of symlinks when processing certain packages (notably in the xar component on macOS). The underlying root cause is improper validation of symlinks, which could allow a maliciously crafted package to lead to arbitrary code execution. Apple ...
GHSA-X489-JJWM-52G7 Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP)
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow RFC 6238 § 5.2 and does not "burn" a successfully validated one-time password aka OTP, which allows physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing ...
Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP)
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow RFC 6238 § 5.2 and does not "burn" a successfully validated one-time password aka OTP, which allows physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing ...
CVE-2015-7225
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password aka OTP, which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP...
CVE-2015-7225
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password aka OTP, which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP...
Code injection
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password aka OTP, which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP...
CVE-2015-7225
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password aka OTP, which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP...
CVE-2015-7225
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password aka OTP, which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP...
CVE-2015-7225
Concretely, CVE-2015-7225 affects devise-two-factor prior to v4.0.2, where an OTP can be reused for one immediately trailing time interval due to an incomplete fix. Multiple connected records (e.g., CVE-2021-43177 references) confirm the vulnerability pattern and the remediation: upgrade to devis...
CVE-2016-6238
The CVE-2016-6238 entry concerns Dropbox Lepton 1.0. The vulnerability is in the write_ujpg function (lepton/jpgcoder.cc) and allows remote attackers to cause a denial of service via an out-of-bounds read when processing a crafted JPEG file. This impact is described across multiple sources (NVD, ...
CVE-2015-6238
The CVE-2015-6238 entry concerns the Google Analyticator WordPress plugin. Vulnerable versions are prior to 6.4.9.6, where multiple XSS vectors exist through parameters on the google-analyticator page (ga_adsense, ga_admin_disable_DimentionIndex, ga_downloads_prefix, ga_downloads, ga_outbound_pre...
Google Analyticator 6.4.9.4 Cross Site Scripting
Information -------------------- Advisory by Netsparker. Name: Multiple XSS Vulnerabilities in Google Analyticator Affected Software : Google Analyticator WordPress Plugin Affected Versions: 6.4.9.4 and possibly below Vendor Homepage : https://wordpress.org/plugins/google-analyticator/...
CVE-2014-6238
CVE-2014-6238 is a Cross-Site Scripting (XSS) vulnerability affecting the TYPO3 extension Akronymmanager (aka SB Folderdownload) version 0.5.0 and earlier. The connected TYPO3 security bulletin lists sb_akronymmanager as vulnerable with XSS via unspecified vectors, but does not provide exploit de...