Mozilla Firefox Private Browsing Mode

The vulnerability of Mozilla Firefox’s Private Browsing Mode and Thunderbird’s email client on Android operating systems is related to incorrect encoding during the generation of output data. Exploiting this vulnerability can allow remote attackers to enhance their privileges and gain unauthorize...

FFmpeg security vulnerabilities

FFmpeg is a complete solution for recording, converting, and streaming audio and video from the FFmpeg team. A security vulnerability exists in FFmpeg that originates from an insecure file extension check that can be bypassed to trigger an arbitrary demultiplexer by appending a base64-encoded dat...

PT-2025-42738

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.24.9-alt1 OpenTofu versions =2.10.0 Description The issue is a memory exhaustion flaw in the encoding/asn1 package of the Go programming language. The code pre-allocates memory based on fields within a DER structure befo...

graphql-java:GraphqlFuzzer: Security exception in java.base/java.nio.ByteBuffer.wrap

Detailed Report: https://oss-fuzz.com/testcase?key=6237409125138432 Project: graphql-java Fuzzing Engine: libFuzzer Fuzz Target: GraphqlFuzzer Job Type: libfuzzerasangraphql-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: java.base/java.nio.ByteBuffer.wrap...

SAP Business Warehouse XSS

The vulnerability of the SAP Business Warehouse data management and analytics system is related to insufficient encoding of user input data. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks XSS remotely...

Improper Encoding or Escaping of Output

Overview koji is a system for building and tracking RPMS. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output due to improper user input sanitization. Remediation Upgrade koji to version 1.33.2, 1.34.3, 1.35.1 or higher. References - Koji Commit - Koji Issu...

CLSA-2024-1734705832 Fix CVE(s): CVE-2024-6923

SECURITY UPDATE: Improper quoting of newlines for email headers allows for header injection - debian/patches/CVE-2024-6923.patch: Encode newlines in headers and verify headers are safe - CVE-2024-6923...

CLSA-2024-1734643101 Fix CVE(s): CVE-2024-6923

SECURITY UPDATE: Improper newline quoting in email module header serialization - debian/patches/CVE-2024-6923.patch: Encode newlines in headers and verify headers to be sound - CVE-2024-6923...

PT-2025-3649

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to v6.6 Description The issue is related to the encoding of file handles in the Linux kernel. The encode fh method may fail for various reasons, and some users of exportfs encode fh,fid have a WARN ON assertion when...

Important: ruby

Issue Overview: An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier's...

Exploit for Cross-site Scripting in Ruoyi

Authenticated SQL Injection in RuoYi v4.7.9 Bypass of CVE-202...

encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion

A flaw was found in the encoding/gob package of the Golang standard library. Calling Decoder.Decoding, a message that contains deeply nested structures, can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635...

encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion

A flaw was found in the encoding/gob package of the Golang standard library. Calling Decoder.Decoding, a message that contains deeply nested structures, can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635...

ALSA-2024:11216 Moderate: containernetworking-plugins security update

The Container Network Interface CNI project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated...

SUSE SLED15: aom-tools / libaom-devel / libaom-devel-doc / libaom3 / etc (SUSE-SU-2024:4333-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:4333-1 advisory. libaom was updated to version 3.7.1: Bug Fixes: - aomedia:3349: heap overflow when increasing resolution ...

SUSE-SU-2024:4333-1 Security update for libaom, libyuv

This update for libaom, libyuv fixes the following issues: libaom was updated to version 3.7.1: Bug Fixes: - aomedia:3349: heap overflow when increasing resolution - aomedia:3478: GCC 12.2.0 emits a -Wstringop-overflow warning on aom/av1/encoder/motionsearchfacade.c - aomedia:3489: Detect encoder...

BIT-NODE-MIN-2024-22019

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service DoS. The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk...

BIT-GITLAB-2024-8179 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. Improper output encoding could lead to XSS if CSP is not enabled...

Unspecified Vulnerability in JetBrains YouTrack

JetBrains YouTrack is a project management tool, developed by JetBrains, supporting cloud hosting and local deployment, providing task management, team collaboration, time tracking and other features for software development, human resources and other scenarios. JetBrains YouTrack suffers from a...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-50194)

"The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-50194 advisory. - In the Linux kernel, the following vulnerability has been resolved: arm64: probes: Fix uprobes for big-...