Improper Input Validation

firefox is vulnerable to Improper Input Validation. The vulnerability is due to improper data handling leading to the creation of invalid Wasm values, potentially converting arbitrary integers into pointer values...

SUSE CVE-2024-2606

Passing invalid data could have led to invalid wasm values being created, such as arbitrary integers turning into pointer values. This vulnerability affects Firefox 124...

curl: excessively long file name may lead to unknown HSTS status

A security bypass flaw was found in Curl, which can be triggered by saving HSTS data to an excessively long file name. This issue occurs due to an error in handling HSTS long file names, leading to the removal of all contents from the file during the save process, and may allow a remote attacker ...

BIT-GITLAB-2022-2534

An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab was returning contributor emails due to improper data handling in the Datadog integration...

BIT-GITLAB-2022-3639

A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 10.8 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. Improper data handling on branch creation could have been used to trigger high CPU usage...

The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird arises from incorrect elimination of special elements in the output data used by the incoming components. This allows an attacker to execute arbitrary code.

The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to incorrect elimination of special elements in the output data used by the incoming component. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CentOS 9 : krb5-1.21.1-1.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the krb5-1.21.1-1.el9 build changelog. - kdc/dotgsreq.c in MIT Kerberos 5 aka krb5 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an...

Information Disclosure

nonebot2 is vulnerable to Information Disclosure. The vulnerability is due to improper handling of user-provided data in a MessageTemplate, which could result in sensitive information disclosure if the user input is used in templates without adequate filtering...

Cisco Unified Communications Products Command Execution Vulnerability

Cisco Unified Communications Products is a series of unified communications products from the U.S. company Cisco Cisco. A command execution vulnerability exists in Cisco Unified Communications Products that stems from improper handling of user-supplied data read into memory. An attacker could...

Cisco Unified Communications Products 安全漏洞

Cisco Unified Communications Products is a series of unified communications products from the U.S. company Cisco Cisco. A command execution vulnerability exists in Cisco Unified Communications Products that stems from improper handling of user-supplied data read into memory. An attacker could...

The vulnerability in Intel NUC’s built-in software, related to errors in processing input data, allows attackers to exploit their privileges.

The vulnerability of Intel NUC’s built-in software is related to errors in processing input data. Exploiting this vulnerability can allow attackers to gain increased privileges...

GitLab 10.8 < 15.1.6 / 15.2 < 15.2.4 / 15.3 < 15.3.2 (CVE-2022-3639)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 10.8 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3....

Security Bulletin: IBM Security Guardium is affected by a multiple vulnerabilities (CVE-2023-39975, CVE-2023-34042)

Summary IBM Security Guardium has fixed these vulnerabilities Vulnerability Details CVEID:CVE-2023-39975 DESCRIPTION: MIT Kerberos 5 aka krb5 is vulnerable to a denial of service, caused by a double free in KDC TGS processing. By sending a specially crafted request, a remote authenticated attacke...

CVE-2023-28022

HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data...

Are HTTP Content-Security-Policy (CSP) Headers Sufficient to Secure Your Client Side?

Modern web frameworks have shifted business logic from the server side to the client side web browser, enhancing performance, flexibility, and user experience. However, this move introduces security and privacy concerns, as exposing sensitive logic and data can lead to vulnerabilities like code...

The vulnerability of Tenda IP cameras’ microprogramming software is related to improper protection of the alternative path, allowing intruders to execute arbitrary commands.

The vulnerability of Tenda IP cameras’ microprogramming software is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2023-7339 · Kingsoft · Wps Office

Name of the Vulnerable Software and Affected Versions: WPS Office version 11.2.0.11537 Description: The issue is related to an uninitialized pointer use in the functionality that handles Data elements in an Excel file. This can be exploited by providing a specially crafted malformed file,...

SUSE CVE-2023-39975

kdc/dotgsreq.c in MIT Kerberos 5 aka krb5 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an authorization-data handling failure. Incorrect data is copied from one ticket to another...

PT-2023-6955 · Crushftp · Crushftp

Name of the Vulnerable Software and Affected Versions: CrushFTP versions prior to 10.5.1 Description: The issue is related to errors in handling input data in the Object Attribute Handler component of the CrushFTP cross-platform FTP server. Exploitation of this issue may allow a remote attacker t...

krb5: double-free in KDC TGS processing

A vulnerability was found in MIT krb5, where an authenticated attacker can cause a KDC to free the same pointer twice if it can induce a failure in authorization data handling...