19366 matches found
GHSA-64VR-G452-QVP3 Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS
Summary We discovered a DOM Clobbering vulnerability in Vite when building scripts to cjs/iife/umd output format. The DOM Clobbering gadget in the module can lead to cross-site scripting XSS in web pages where scriptless attacker-controlled HTML elements e.g., an img tag with an unsanitized name...
Microsoft SQL Server Masked Data Exposure
Title: SQL Server Masked Data Exposure Through Brute Force Attack Product: Database Manufacturer: Microsoft Affected Versions: SQL Server 2014, 2016,2017,2019,2022 Tested Versions: SQL Server 2014, 2016,2017,2019,2022 Risk Level: Low Security Feature: Dynamic Data Masking Author of Advisory: Emad...
Adobe After Effects Heap Buffer Overflow
The vulnerability of Adobe After Effects video and dynamic image editing software relates to the execution of operations beyond buffer boundaries in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code in the context of the current user, using a specially created...
Adobe After Effects Buffer Overflow
The vulnerability of Adobe After Effects video and dynamic image editing software relates to buffer overflow in dynamic memory. Exploiting this vulnerability allows an attacker to execute arbitrary code in the context of the current user, using a specially created malicious file...
Vim do_search() Compromise
The vulnerability of the dosearch function in the Vim text editor is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...
PT-2024-25642
Name of the Vulnerable Software and Affected Versions Acronis Cyber Protect Cloud Agent Windows versions before build 38235 Description A local privilege escalation issue exists due to a DLL hijacking vulnerability. This can cause local privilege escalation. Recommendations For Acronis Cyber...
Acronis Cyber Protect code-related vulnerabilities
Acronis Cyber Protect is an all-in-one cyber protection solution for business and enterprise from Acronis Switzerland. Combining backup, anti-malware, network security and endpoint management features such as vulnerability assessment, URL filtering, patch management and more. A code issue...
PT-2024-39236 · Acronis · Acronis Cyber Protect 16 +1
Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect Cloud Agent Windows versions before build 38235 Acronis Cyber Protect 16 Windows versions before build 39169 Description: A DLL hijacking vulnerability can lead to local privilege escalation. This issue affects Acronis...
OSV-2024-1071 Use-of-uninitialized-value in Poco::Dynamic::Var::~Var
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538385 Crash type: Use-of-uninitialized-value Crash state: Poco::Dynamic::Var::Var void Poco::JSON::Object::doStringifystd::1::mapstd::1::basicstringchar, Poco::JWT::Serializer::serialize...
PT-2024-40574 · Poco · Poco
Name of the Vulnerable Software and Affected Versions: Poco affected versions not specified Description: The issue is related to a crash caused by the use of an uninitialized value. The crash occurs in the Poco::Dynamic::Var destructor and is associated with the Poco::JSON::Object::doStringify...
poco:jwt_decode_fuzzer: Use-of-uninitialized-value in Poco::Dynamic::Var::~Var
Project: https://github.com/pocoproject/poco.git Detailed Report: https://oss-fuzz.com/testcase?key=5129032620900352 Project: poco Fuzzing Engine: libFuzzer Fuzz Target: jwtdecodefuzzer Job Type: libfuzzermsanpoco Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash Stat...
iCUEUpdateService Privilege Escalation
The vulnerability of the iCUEUpdateService service in the CORSAIR iCUE management system is related to insufficient protection of service data due to the loading of dynamic libraries MSASN1.dll, NTASN1.dll, and profapi.dll into the \cuepkg-1.2.6 directory. Exploiting this vulnerability can allow...
Microsoft Office Buffer Overflow
The vulnerability of the Microsoft Office suite is related to overflowing buffers in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2024-45303 Discourse Calendar plugin event names susceptible to XSS
Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse. Rendering event names can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. The issue ...
CVE-2024-40457
No-IP Dynamic Update Client DUC v3.x uses cleartext credentials that may occur on a command line or in a file. NOTE: the vendor's position is that cleartext in /etc/default/noip-duc is recommended and is the intentional behavior...
No-IP Dynamic Update Client security vulnerability
No-IP Dynamic Update Client is a dynamic update software from No-IP. A security vulnerability exists in No-IP Dynamic Update Client version v3.x that originates from the use of plaintext credentials that may appear on the command line or in a file...
CVE-2024-40457: Cleartext Storage of Sensitive Information
No-IP Dynamic Update Client DUC v3.x uses cleartext credentials that may occur on a command line or in a file. NOTE: the vendor's position is that cleartext in /etc/default/noip-duc is recommended and is the intentional behavior...
GitLab security vulnerabilities
GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A security vulnerability exists in GitLab EE versions 13.3 to before 17.1.7,...
PT-2024-21894 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab-EE versions 13.3 through 17.1.7 GitLab-EE versions 17.2 through 17.2.5 GitLab-EE versions 17.3 through 17.3.2 Description: An issue was discovered in GitLab-EE that would allow an attacker to modify an on-demand DAST scan without...
CVE-2024-40457
No-IP Dynamic Update Client DUC v3.x uses cleartext credentials that may occur on a command line or in a file. NOTE: the vendor's position is that cleartext in /etc/default/noip-duc is recommended and is the intentional behavior...