CVE-2024-33434

An issue in tiagorlampert CHAOS v5.0.1 before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e allows a remote attacker to execute arbitrary code via the unsafe concatenation of the filename argument into the buildStr string without any sanitization or filteri...

CVE-2024-33434

An issue in tiagorlampert CHAOS before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e allows a remote attacker to execute arbitrary code via the unsafe concatenation of the filename argument into the buildStr string without any sanitization or filtering...

CVE-2024-33434

An issue in tiagorlampert CHAOS v5.0.1 before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e allows a remote attacker to execute arbitrary code via the unsafe concatenation of the filename argument into the buildStr string without any sanitization or filteri...

CVE-2024-33434

An issue in tiagorlampert CHAOS v5.0.1 before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e allows a remote attacker to execute arbitrary code via the unsafe concatenation of the filename argument into the buildStr string without any sanitization or filteri...

CHAOS 安全漏洞

github Chaos is a software application. Visualize the connection between Chaos Theory and Fractals via Logical Mapping;. A security vulnerability exists in CHAOS. A remote attacker can exploit this vulnerability to execute arbitrary code by insecurely concatenating the "filename" parameter to the...

CVE-2024-33434

CVE-2024-33434 affects tiagorlampert CHAOS (v5.0.1 before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e). The root cause is unsafe concatenation of the filename argument into buildStr without sanitization, enabling remote code execution. Public reports desc...

GHSA-2Q8V-3GQQ-4F8P concat built-in can corrupt memory in vyper

Summary concat built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The root cause is that the buildIR for concat doesn't properly adhere to the API of copy functions for =0.3.2 the copybytes function. A contract search was...

Transaction Cross Linking

Hyperledger Fabric is vulnerable to Transaction Cross Linking. The vulnerability is due to the insecure concatenation of transactions in a block, allowing an adversary to craft a cross-linked block resulting in Transaction Cross Linking...

kernel: bnxt: Do not read past the end of test names

A flaw was found in the bnxten module in the Linux kernel. An out-of-bounds read can occur due to an incorrect concatenation of test names, causing a system crash that results in a denial of service...

kernel: bnxt: Do not read past the end of test names

A flaw was found in the bnxten module in the Linux kernel. An out-of-bounds read can occur due to an incorrect concatenation of test names, causing a system crash that results in a denial of service...

PT-2023-4770 · Unknown · Php-Fusion

Name of the Vulnerable Software and Affected Versions: PHPFusion affected versions not specified Description: The issue is related to insufficient sanitization of tainted file names that are directly concatenated with a path and subsequently passed to a require once statement. This allows arbitra...

Remote Code Execution (RCE)

org.jenkins-ci.plugins: convert-to-pipeline is vulnerable to Remote Code Execution RCE. The vulnerability exists due to improperly converting the build environment, build steps, and post-build actions of freestyle projects to the corresponding pipeline step invocations via simple string...

Threat Actors Using Obfuscation in Attempt to Evade Detection

As part of our product lineup, we offer security monitoring and malware removal services to our Wordfence Care and Response customers. In the event of a security incident, our incident response team will investigate the root cause, find and remove malware from your site, and help with other...

Pool address predictability creates many problems

Lines of code Vulnerability details Impact The Aquifer.boreWell function is responsible for creating new Well. This is done using the LibClone.cloneDeterministic function. The address of the new Well depends solely on the salt and/or immutableData parameter provided by the user. Once a user creat...

DEBIAN-CVE-2020-36732

The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary...

Node.js 安全特征问题漏洞

Node.js is an open source, cross-platform JavaScript runtime environment. A security vulnerability exists in versions of Node.js prior to version 3.2.1 that stems from the crypto-js package generating random numbers by concatenating strings, but using integers, which makes the output predictable...

php: Overflowing the length of string causes crash

An integer overflow vulnerability in PHP can lead to a buffer overflow when constructing extremely long strings with the ".=" operator. In unusual circumstances, this could be used by an attacker to cause an application to crash or possibly have other consequences...

PT-2023-19177 · Joomla · Visforms Base Package For Joomla

Name of the Vulnerable Software and Affected Versions: Visforms Base Package for Joomla 3 affected versions not specified Description: The issue allows an attacker to interact with the database, potentially enabling them to read, modify, and delete data, due to the use of concatenation in...

Sql injection

Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. User input coming from the dbname in the sql/datadictionary.py tablelist endpoint is passed to the methods that follow in...

The vulnerability of the `findGarbageCode` function of the Cppcheck static analyzer allows an attacker to trigger a service failure by attempting to read beyond the allocated memory boundary.

The vulnerability of the findGarbageCode function of the Cppcheck static analyzer is related to attempts to read beyond the allocated memory boundary, during the concatenation of strings when calling std::operator+. Exploiting this vulnerability can allow an attacker to trigger a service failure...