5267 matches found
GHSA-WXR3-2HGV-QM8F node-twain vulnerable to Improper Check or Handling of Exceptional Conditions
All versions of the package node-twain are vulnerable to Improper Check or Handling of Exceptional Conditions due to the length of the source data not being checked. Creating a new twain.TwainSDK with a productName or productFamily, manufacturer, version.info property of length = 34 chars leads t...
CVE-2024-21525
All versions of the package node-twain are vulnerable to Improper Check or Handling of Exceptional Conditions due to the length of the source data not being checked. Creating a new twain.TwainSDK with a productName or productFamily, manufacturer, version.info property of length = 34 chars leads t...
CVE-2024-21525
CVE-2024-21525 affects the node-twain package. The root cause is improper checking/handling of exceptionally long source data when constructing a new twain.TwainSDK with properties like productName, productFamily, manufacturer, or version.info whose length is >= 34 characters, causing a buffer...
Undici vulnerable to data leak when using response.arrayBuffer()
Impact Depending on network and process conditions of a fetch request, response.arrayBuffer might include portion of memory from the Node.js process. Patches This has been patched in v6.19.2. Workarounds There are no known workaround. References https://github.com/nodejs/undici/issues/3337...
Memory Disclosure
Undici is vulnerable to Memory Leakage. The vulnerability is due to the response.arrayBuffer method, which potentially allows an attacker to exposes sensitive portions of memory from Node.js process depending on the network and process conditions...
CVE-2024-38372
Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a fetch request, response.arrayBuffer might include portion of memory from the Node.js process. This has been patched in v6.19.2...
Pen testing cruise ships
New build ships contracted for build from 1st July 2024 must comply with IACS UR E26 & 27. What does this mean for assessing the cyber security of a cruise ship? What’s the risk profile? Cruise ships have a unique risk profile. This is due to the huge number of guests on board, highly complex...
The vulnerability of the btrfs_set_item_key_safe() function in the Linux operating system allows a hacker to execute arbitrary code.
The vulnerability of the btrfssetitemkeysafe function in the Linux operating system’s kernel is related to synchronization errors when using shared resources „Race Conditions“. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
Apache Tomcat - Denial of Service
Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of...
Apache Tomcat 10.1.0.M1 < 10.1.25
The version of Tomcat installed on the remote host is prior to 10.1.25. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat10.1.25security-10 advisory. - Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in...
CVE-2024-20894
Improper handling of exceptional conditions in Secure Folder prior to SMR Jul-2024 Release 1 allows physical attackers to bypass authentication under certain condition. User interaction is required for triggering this vulnerability...
PT-2024-18807 · Samsung · Secure Folder
Name of the Vulnerable Software and Affected Versions: Secure Folder versions prior to SMR Jul-2024 Release 1 Description: The issue arises from improper handling of exceptional conditions, allowing physical attackers to bypass authentication under certain conditions. User interaction is required...
CVE-2024-21586
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS on SRX Series and NFX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service DoS. If an affected device receives specific valid...
CVE-2024-32936
In the Linux kernel, the following vulnerability has been resolved: media: ti: j721e-csi2rx: Fix races while restarting DMA After the frame is submitted to DMA, it may happen that the submitted list is not updated soon enough, and the DMA callback is triggered before that. This can lead to kernel...
CVE-2024-6027
The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to time-based SQL Injection via the ‘conditions’ parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
WordPress plugin Themify security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
SUSE SLES15 Security Update : kernel RT (Live Patch 10 for SLE 15 SP5) (SUSE-SU-2024:2092-1)
The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2092-1 advisory. This update for the Linux Kernel 5.14.21-1505001335 fixes several issues. The following security issues were fixed: - CVE-2024-26852: Fixed...
OESA-2024-1730 microcode_ctl security update
This is a tool to transform and deploy microcode update for x86 CPUs. Security Fixes: Hardware logic contains race conditions in some IntelR Processors may allow an authenticated user to potentially enable partial information disclosure via local access.CVE-2023-45733 Improper input validation in...
