CVE-2023-40598

In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code ...

UBUNTU-CVE-2023-4579

Search queries in the default search engine could appear to have been the currently navigated URL if the search query itself was a well formed URL. This could have led to a site spoofing another if it had been maliciously set as the default search engine. This vulnerability affects Firefox 117...

CVE-2023-39834

PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via createfunction...

AZL-28048 CVE-2022-47011 affecting package binutils for versions less than 2.37-9

An issue was discovered function parsestabstructfields in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks...

AZL-44817 CVE-2022-43358 affecting package libsass for versions less than 3.6.6-1

Stack overflow vulnerability in astselectors.cpp: in function Sass::ComplexSelector::hasplaceholder in libsass:3.6.5-8-g210218, which can be exploited by attackers to cause a denial of service DoS...

AZL-32226 CVE-2022-26592 affecting package reaper for versions less than 3.1.1-9

Stack Overflow vulnerability in libsass 3.6.5 via the CompoundSelector::hasrealparentref function...

AZL-28094 CVE-2021-34193 affecting package opensc for versions less than 0.23.0-1

Stack overflow vulnerability in OpenSC smart card middleware before 0.23 via crafted responses to APDUs...

AZL-28060 CVE-2021-32292 affecting package json-c for versions less than 0.15-2

An issue was discovered in json-c from 20200420 post 0.14 unreleased code through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program jsonparse which is located in the function parseit...

AZL-45111 CVE-2020-35357 affecting package gsl for versions less than 2.8-1

A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL GNU Scientific Library, versions 2.5 and 2.6. Processing a maliciously crafted input data for gslstatsquantilefromsorteddata of the library may lead to unexpected application termination or arbitra...

AZL-28597 CVE-2020-22217 affecting package python-gevent for versions less than 21.1.2-1

Buffer overflow vulnerability in c-ares before 1161 thru 1170 via function aresparsesoareply in aresparsesoareply.c...

AZL-44868 CVE-2020-18770 affecting package zziplib for versions less than 0.13.74-1

An issue was discovered in function zzipdiskentrytofileheader in mmapped.c in zziplib 0.13.69, which will lead to a denial-of-service...

AZL-27940 CVE-2023-32002 affecting package nodejs for versions less than 16.20.2-2

The use of Module.load can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CV...

CVE-2023-34412

A vulnerability in Red Lion Europe mbNET/mbNET.rokey and Helmholz REX 200 and REX 250 devices with firmware lower 7.3.2 allows an authenticated remote attacker with high privileges to inject malicious HTML or JavaScript code XSS...

CVE-2023-2910

Improper neutralization of special elements used in a command 'Command Injection' vulnerability in Printer service functionality in ASUSTOR Data Master ADM allows remote unauthorized users to execute arbitrary commands via unspecified vectors. Affected products and versions include: ADM 4.0.6.RIS...

AZL-27926 CVE-2023-32006 affecting package nodejs18 for versions less than 18.17.1-2

The use of module.constructor.createRequire can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note th...

AZL-27892 CVE-2023-39417 affecting package postgresql for versions less than 14.10-1

IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct dollar quoting, '', or "". If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with...

AZL-27937 CVE-2023-28938 affecting package mdadm for versions less than 4.1-11

Uncontrolled resource consumption in some IntelR SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access...

AZL-27938 CVE-2023-28736 affecting package mdadm for versions less than 4.1-10

Buffer overflow in some IntelR SSD Tools software before version mdadm-4.2-rc2 may allow a privileged user to potentially enable escalation of privilege via local access...

AZL-34770 CVE-2023-33953 affecting package grpc for versions less than 1.62.0-2

gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks: - Unbounded memory buffering in the HPACK parser - Unbounded CPU consumption ...

AZL-39394 CVE-2023-33953 affecting package python-tensorboard for versions less than 2.11.0-2

gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks: - Unbounded memory buffering in the HPACK parser - Unbounded CPU consumption ...