CVE-2023-44390

HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. The vulnerability occurs in configurations where foreign content is allowed, i.e. either svg or math are in the list of allowed elements. In the case an application sanitizes us...

Important: curl

Issue Overview: HTTP headers eat all memory NOTE: https://www.openwall.com/lists/oss-security/2023/09/13/1 NOTE: https://curl.se/docs/CVE-2023-38039.html NOTE: Introduced by: https://github.com/curl/curl/commit/7c8c723682d524ac9580b9ca3b71419163cb5660 curl-7830 NOTE: Experimental tag removed in:...

PT-2023-19825 · Qualcomm · Snapdragon +180

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned as affected in the provided descriptions. Description: The issue involves memory corruption in HLOS when importing a cryptographic key into the KeyMaster Trusted Application. This occurs due to a...

PT-2023-29137 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue is related to the 'name' parameter of the process registration.php resource, which does not validate the characters received, and they are sent unfiltered to the database...

PT-2023-9291 · Libnbd +5 · Libnbd +5

Name of the Vulnerable Software and Affected Versions: libnbd affected versions not specified Description: A flaw was found in libnbd where a server can reply with a block size larger than 2^63, which is a 64-bit unsigned value according to the NBD spec. This issue could lead to an application...

PT-2023-8795 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a memory leak in the drm bridge get edid function of the Linux kernel's meson component. This leak occurs on the -hpd notify callback. The EDID returned by drm...

PT-2023-15405 · Rcpbind · Rcpbind

Name of the Vulnerable Software and Affected Versions: No specific software name is mentioned, but the affected service is RCPbind, and the affected versions are not specified. Description: The issue concerns a vulnerability in the RCPbind service running on UDP port 111, allowing a remote attack...

PT-2023-15404 · Ormazabal · Ekorccp +3

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website. This could allow a...

PT-2023-15397 · Ekorccp +1 · Ekorccp +1

Name of the Vulnerable Software and Affected Versions: ekorCCP and ekorRCI affected versions not specified Description: The issue is an operating system command injection in ekorCCP and ekorRCI, which could allow an authenticated attacker to execute commands, create new users with elevated...

PT-2023-36021 · Git +1 · Icu

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of UNKNOWN WRITE. The crash state involves the icu 74::Calendar::set function, as indicated by the calendar fuzzer.c...

PT-2023-5459 · Microsoft · Edge

Name of the Vulnerable Software and Affected Versions: Microsoft Edge affected versions not specified Description: The issue is related to insufficient input validation in Microsoft Edge, allowing an attacker to potentially elevate their privileges. Recommendations: At the moment, there is no...

PT-2023-11054 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The provided information does not contain details about the issue, affected devices, or real-world incidents. Recommendations: At the moment, there is no information about a newer versi...

PT-2023-36264 · Hashicorp · Terraform-Provider-Aws

Name of the Vulnerable Software and Affected Versions: terraform-provider-aws affected versions not specified Description: The issue is related to a security release in the Go programming language, version 1.21. The terraform-provider-aws package has been rebuilt to incorporate this security...

PT-2023-36262 · Hashicorp · Terraform-Provider-Helm

Name of the Vulnerable Software and Affected Versions: terraform-provider-helm affected versions not specified Description: The issue is related to a security release in Go 1.21. The terraform-provider-helm package has been rebuilt with this security release to address the issue. There is no...

PT-2023-36002 · Git +1 · Kamailio

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of UNKNOWN READ. The crash state involves functions such as parse priv value and parse privacy, which are located in...

PT-2023-4827 · Freebsd · Freebsd

Name of the Vulnerable Software and Affected Versions: FreeBSD affected versions not specified Description: The issue is related to errors in the packet filter component of FreeBSD, specifically with the 'scrub fragment reassemble' rule. This can allow a remote attacker to bypass existing firewal...

PT-2023-4832 · Imind · Imind

Name of the Vulnerable Software and Affected Versions: iMind affected versions not specified Description: The issue is related to the possibility of code or data injection, which could allow a remote attacker to execute arbitrary code with administrative privileges. Recommendations: At the moment...

PT-2023-36257 · Amazon · Amazon-Ssm-Agent

Name of the Vulnerable Software and Affected Versions: amazon-ssm-agent affected versions not specified Description: The issue is related to a security release in the go 1.21 package, which is used by the amazon-ssm-agent. The package has been rebuilt with the go 1.21 security release to address...

PT-2023-21808 · Wlan Hal · Wlan Hal

Name of the Vulnerable Software and Affected Versions: WLAN HAL affected versions not specified Description: The issue is related to memory corruption in the WLAN HAL when processing the devIndex from an untrusted WMI payload. This can lead to potential security risks. There is no information...

PT-2023-26448 · Unknown · Vowifiservice

Name of the Vulnerable Software and Affected Versions: vowifiservice affected versions not specified Description: The issue is related to a possible missing permission check in vowifiservice. This could lead to local escalation of privilege with no additional execution privileges. Recommendations...