14437 matches found
CVE-2023-30586
CVE-2023-30586: Privilege escalation in Node.js 20 when the experimental permission model is enabled. An OpenSSL engine loaded via crypto.setEngine() can bypass or disable the permission model by manipulating host process memory (e.g., locating Permission::enabled_ on the heap). Affected: Node.js...
CVE-2021-31982
CVE-2021-31982 affects Microsoft Edge (Chromium-based). It is a Security Feature Bypass vulnerability (CVSS v3.1 base score 8.8; Network attack, Low complexity, User interaction required). The issue is addressed by Microsoft Edge updates listed in the MSRC guidance; remediation is to install the ...
CVE-2021-31982 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
...
CVE-2021-31982 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
...
CVE-2021-34506 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
...
CVE-2021-34506 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
...
WhatsApp Upgrades Proxy Feature Against Internet Shutdowns
Meta's WhatsApp has rolled out updates to its proxy feature, allowing more flexibility in the kind of content that can be shared in conversations. This includes the ability to send and receive images, voice notes, files, stickers and GIFs, WhatsApp told The Hacker News. The new features were firs...
WhatsApp Upgrades Proxy Feature Against Internet Shutdowns
Meta's WhatsApp has rolled out updates to its proxy feature, allowing more flexibility in the kind of content that can be shared in conversations. This includes the ability to send and receive images, voice notes, files, stickers and GIFs, WhatsApp told The Hacker News. The new features were firs...
Cross-site Scripting (XSS)
sheng/yiicms is vulnerable to Cross-Site Scripting XSS. The vulnerability exists due to the lack of a validation in the news features form elements, which allows an attacker to inject and execute arbitrary JavaScript into the browser...
Node.js: Policy-restricted modules can escalate to higher privileges by impersonating other modules in a policy list using module.constructor.createRequire()
A vulnerability was discovered in Node.js that allowed policy-restricted modules to gain higher privileges by impersonating other modules in a policy list using module.constructor.createRequire. This vulnerability affected all users using the experimental policy mechanism in Node.js versions 16.x...
PT-2023-25898
Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.172 Description The issue arises from the improper sanitization of the title for layout in Correlations, CorrelationExclusions, and Layouts. This could potentially lead to security issues, although specific details...
PT-2023-21674 · Brave · Brave Browser
Name of the Vulnerable Software and Affected Versions: Brave Browser Android versions prior to 1.52.117 Description: An Open Redirect issue exists where the built-in QR scanner in Brave Browser Android navigated to scanned URLs automatically without showing the URL first. Now, the user must...
Security feature bypass
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki installation is upgraded and that upgrade contains a fix for a bug in a document, just a new version of that document is added. In some cases, it's still possible to exploit the...
Critical SQL Injection Flaws Expose Gentoo Soko to Remote Code Execution
Multiple SQL injection vulnerabilities have been disclosed in Gentoo Soko that could lead to remote code execution RCE on vulnerable systems. "These SQL injections happened despite the use of an Object-Relational Mapping ORM library and prepared statements," SonarSource researcher Thomas...
Critical SQL Injection Flaws Expose Gentoo Soko to Remote Code Execution
Multiple SQL injection vulnerabilities have been disclosed in Gentoo Soko that could lead to remote code execution RCE on vulnerable systems. "These SQL injections happened despite the use of an Object-Relational Mapping ORM library and prepared statements," SonarSource researcher Thomas...
SUSE CVE-2023-36660
The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption...
CVE-2022-48331
Widevine Trusted Application TA 5.0.0 through 5.1.1 has a drmsavekeys featurenamelen integer overflow and resultant buffer overflow...
PT-2023-15710 · Google · Widevine Trusted Application
Name of the Vulnerable Software and Affected Versions: Widevine Trusted Application TA versions 5.0.0 through 5.1.1 Description: The issue is related to an integer overflow and resultant buffer overflow in the drm save keys feature, specifically with the feature name len. Recommendations: For...
