6750 matches found
Updated openssl packages fix security vulnerabilities
The updated packages fix security vulnerabilities: Excessive time spent in DH check / generation with large Q parameter value. CVE-2023-5678 POLY1305 MAC implementation corrupts vector registers on PowerPC. CVE-2023-6129 Excessive time spent checking invalid RSA public keys. CVE-2023-6237 PKCS12...
MGASA-2024-0020 Updated openssl packages fix security vulnerabilities
The updated packages fix security vulnerabilities: Excessive time spent in DH check / generation with large Q parameter value. CVE-2023-5678 POLY1305 MAC implementation corrupts vector registers on PowerPC. CVE-2023-6129 Excessive time spent checking invalid RSA public keys. CVE-2023-6237 PKCS12...
FAUST: A Phobos Ransomware Variant Launches Fileless Attack
Summary: FAUST ransomware, a variant of the Phobos family, exhibiting intricate deployment stages, from decoding Base64 data to injecting shellcode. Notably, it employs a fileless attack through an Office document with a VBA script, emphasizing the need for user caution with document files from...
OpenSSL -- Multiple vulnerabilities
The OpenSSL project reports: Excessive time spent checking invalid RSA public keys CVE-2023-6237 PKCS12 Decoding crashes CVE-2024-0727...
PKCS12 Decoding crashes
...
serenity:FuzzWebPLoader: Crash in Gfx::ColorIndexingTransform::transform
Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=4871909552488448 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzWebPLoader Job Type: libfuzzerubsanserenity Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7808ff1e40...
Avalanche mobile device management system Decryption Unauthorized Access
The vulnerability of the decoding method used by the Avalanche mobile device management system lies in the writing beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or cause service failures...
Cross site scripting
The Print Invoice & Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders page. This means that this vulnerability can be exploited for users with the editothersshoporders capability...
CVE-2024-0556
A Weak Cryptography for Passwords vulnerability has been detected on WIC200 affecting version 1.1. This vulnerability allows a remote user to intercept the traffic and retrieve the credentials from another user and decode it in base64 allowing the attacker to see the credentials in plain text...
Design/Logic Flaw
A Weak Cryptography for Passwords vulnerability has been detected on WIC200 affecting version 1.1. This vulnerability allows a remote user to intercept the traffic and retrieve the credentials from another user and decode it in base64 allowing the attacker to see the credentials in plain text...
Xantech WIC1200 Security Vulnerability
The Xantech WIC1200 is a Web Intelligence Controller from Xantech. A security vulnerability exists in the Xantech WIC1200 version 1.1 that originates from a vulnerability that allows a remote user to intercept traffic and retrieve other users' credentials and decode them in Base64, which can be...
SUSE CVE-2023-38653
Multiple integer overflow vulnerabilities exist in the VZT vztrdblockvchdecode dict parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the...
PT-2024-12751 · Gtkwave · Gtkwave
Name of the Vulnerable Software and Affected Versions: GTKWave version 3.3.115 Description: Multiple integer overflow vulnerabilities exist in the VZT vzt rd block vch decode times parsing functionality. A specially crafted .vzt file can lead to memory corruption. A victim would need to open a...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.46 bug fix and security update
Red Hat OpenShift Container Platform release 4.12.46 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...
CVE-2024-21633 Arbitrary file write on Decoding
Apktool is a tool for reverse engineering Android APK files. In versions 2.9.1 and prior, Apktool infers resource files' output path according to their resource names which can be manipulated by attacker to place files at desired location on the system Apktool runs on. Affected environments are...
Algorithmic Complexity
Overview PeterO.Cbor is a C implementation of Concise Binary Object Representation CBOR. Affected versions of this package are vulnerable to Algorithmic Complexity due to use of an inefficient algorithm in the DecodeFromBytes or other decoding mechanisms. An attacker can cause a denial of service...
msgpackr's conversion of property names to strings can trigger infinite recursion
Impact When decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. Patches The fix is available in v1.10.1 Workarounds Exploits seem to require structured cloning, replacing the 0x70 extension with your own that...
CVE-2023-52079
msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. The fix is available in v1.10.1. Exploits seem to require structured...
Information disclosure
msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. The fix is available in v1.10.1. Exploits seem to require structured...
CVE-2023-52079 Conversion of property names to strings can trigger infinite recursion
msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. The fix is available in v1.10.1. Exploits seem to require structured...