CVE-2023-51154

CVE-2023-51154 affects Jizhicms v2.5 via /admin/c/PluginsController.php, enabling arbitrary file download. Reported CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8, CRITICAL). Connected sources confirm the vulnerable component and high impact; exploitation details are not provided in the prima...

glibc: buffer overflow in ld.so leading to privilege escalation

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBCTUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBCTUNABLES environment variables when launching binaries with SUID permission to execute code...

Uncontrolled Resource Consumption ('Resource Exhaustion')

Overview Affected versions of this package are vulnerable to Uncontrolled Resource Consumption 'Resource Exhaustion' via the expandmmacparams function in the nasm-pp.c component. An attacker can cause a crash or disruption of service by sending crafted input. Remediation There is no fixed version...

CBOR Security Breach

CBOR is a C implementation of the Concise Binary Object Representation by the individual developer Peter Occil. A security vulnerability exists in CBOR versions 4.0.0 through 4.5.0, which stems from the use of an inefficient algorithm that makes it susceptible to denial-of-service attacks when...

RHEL 8 : Red Hat Virtualization Host 4.4.z SP 1 (RHSA-2024:0033)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0033 advisory. The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-nod...

UBUNTU-CVE-2023-49551

An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjsopjsonparse function in the msj.c file...

CVE-2023-47039

A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell cmd.exe. When running an executable that uses the Windows Perl interpreter, Perl attempts to find and execute cmd.exe within the operating system...

CVE-2023-26157

Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service DoS due to an out-of-bounds read involving section-numpages in decoder2007.c...

PT-2024-13745 · Cesanta · Mjs

Name of the Vulnerable Software and Affected Versions: Cesanta mjs version 2.20.0 Description: An Out of Bounds Write in Cesanta mjs allows a remote attacker to cause a denial of service via the mjs op json stringify function in the msj.c file. Recommendations: For Cesanta mjs version 2.20.0,...

libredwg Security Vulnerabilities

libredwg is a free implementation of the DWG file format. A security vulnerability exists in libredwg versions prior to 0.12.5.6384, which stems from an out-of-bounds read problem in section-numpages in decoder2007.c. The vulnerability is caused by a read-over-bounds problem in section-numpages...

Fedora: Security Advisory (FEDORA-2023-817ecc703f)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for xerces-c (FEDORA-2023-52ba628e03)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3704-1] xerces-c security update

Debian LTS Advisory DLA-3704-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin December 31, 2023 https://wiki.debian.org/LTS Package : xerces-c Version : 3.2.2+debian-1+deb10u2 CVE ID : CVE-2018-1311 CVE-2023-37536 Debian Bug : 947431 Even Rouault discovered that...

[SECURITY] Fedora 39 Update: xerces-c-3.2.5-1.fc39

Xerces-C is a validating XML parser written in a portable subset of C++. Xerces-C makes it easy to give your application the ability to read and write XML data. A shared library is provided for parsing, generating, manipulating, and validating XML documents. Xerces-C is faithful to the XML 1.0...

[SECURITY] Fedora 38 Update: xerces-c-3.2.5-1.fc38

Xerces-C is a validating XML parser written in a portable subset of C++. Xerces-C makes it easy to give your application the ability to read and write XML data. A shared library is provided for parsing, generating, manipulating, and validating XML documents. Xerces-C is faithful to the XML 1.0...

DLA-3704-1 xerces-c - security update

Bulletin has no description...

Fedora 38 : xerces-c (2023-52ba628e03)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-52ba628e03 advisory. Update to 3.2.5, fixing CVE-2018-1311 and CVE-2023-37536 Tenable has extracted the preceding description block directly from the Fedora security...

Fedora 39 : xerces-c (2023-817ecc703f)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-817ecc703f advisory. Update to 3.2.5, fixing CVE-2018-1311 and CVE-2023-37536 Tenable has extracted the preceding description block directly from the Fedora security...

CERT-UA Uncovers New Malware Wave Distributing OCEANMAP, MASEPIE, STEELHOOK

The Computer Emergency Response Team of Ukraine CERT-UA has warned of a new phishing campaign orchestrated by the Russia-linked APT28 group to deploy previously undocumented malware such as OCEANMAP, MASEPIE, and STEELHOOK to harvest sensitive information. The activity, which was detected by the...

Poly Trio Security Breach

Poly Trio is a Trio series of business conference phones from Poly USA. A security vulnerability exists in Poly CCX and Trio that stems from a security flaw in the Web Interface component. Affected products and versions: Poly CCX version 400, CCX version 600, Trio version 8800, Trio version C60...