9302 matches found
Mozilla: Use-after-free in <code>nsDNSService</code>
The Mozilla Foundation Security Advisory describes this flaw as: A use-after-free was identified in the nsDNSService::Init. This issue appears to manifest rarely during start-up...
WordPress Plugin Webinar SQL Injection Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerability exist...
Apache DolphinScheduler 输入验证错误漏洞
Apache DolphinScheduler is a distributed DAG visualization-based workflow task scheduling system from the Apache Apache Foundation in the United States. A security vulnerability exists in Apache DolphinScheduler 3.1.9 and earlier versions, which can be exploited by an unauthenticated attacker to...
CVE-2023-50968
Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgrade to version 18.12.11, which fixes th...
CVE-2023-50968 Apache OFBiz: Arbitrary file properties reading and SSRF attack
Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgrade to version 18.12.11, which fixes th...
Security Bulletin: The IBM® Engineering Lifecycle Engineering products using WebSphere Application Server Liberty is vulnerable to information disclosure due to Apache Santuario (CVE-2023-44483)
Summary There is a vulnerability in the Apache Santuario library used by IBM WebSphere Application Server Liberty when the wsSecurity-1.1, wsSecuritySaml-1.1 or samlWeb-2.0 feature is enabled. Following IBM® Engineering Lifecycle Engineering products are vulnerable to this attack, it has been...
Linux kernel denial of service vulnerability (CNVD-2024-1476840)
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a denial of service vulnerability that originates from the presence of a null pointer dereference in the function ath10kwmitlvoppullmgmttxcomplev. An...
PT-2023-31463 · Unknown · Foundation
Name of the Vulnerable Software and Affected Versions: Foundation platform version 1.0 Description: The issue allows a remote attacker to obtain sensitive information via the Web3 authentication process of Foundation. The signed message lacks a nonce, which is a random number. This flaw may expos...
Apache Superset Elevation of Privilege Vulnerability
Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from an elevation of privilege vulnerability that can be exploited by an attacker to gain write access to all gauges in a dashboard via the Add Gauge function of Create...
Mozilla Firefox Information Disclosure Vulnerability (CNVD-2024-0019535)
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. An information disclosure vulnerability exists in Mozilla Firefox versions prior to 121, which originated when GNOME disclosed browser tab titles to the system log, and can be exploited by attackers to...
Apache Superset SQL Injection Vulnerability (CNVD-2024-0102192)
Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from a SQL injection vulnerability that can be exploited by an authenticated, remote attacker to send specially crafted SQL statements to the wherein JINJA macro...
CVE-2023-50762
The Mozilla Foundation Security Advisory: When processing a PGP/MIME payload that contains digitally signed text, the first paragraph of the text was never shown to the user. This is because the text was interpreted as a MIME message and the first paragraph was always treated as an email header...
CVE-2023-50761
The Mozilla Foundation Security Advisory: The signature of a digitally signed S/MIME email message may optionally specify the signature creation date and time. If present, Thunderbird did not compare the signature creation date with the message date and time, and displayed a valid signature despi...
CVE-2023-6865
The Mozilla Foundation Security Advisory describes this flaw as: EncryptingOutputStream was susceptible to exposing uninitialized data. This issue could only be abused in order to write data to a local disk which may have implications for private browsing mode...
CVE-2023-6864
The Mozilla Foundation Security Advisory describes this flaw as: Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run...
CVE-2023-6863
The Mozilla Foundation Security Advisory describes this flaw as: The ShutdownObserver was susceptible to potentially undefined behavior due to its reliance on a dynamic type that lacked a virtual destructor...
CVE-2023-6862
The Mozilla Foundation Security Advisory describes this flaw as: A use-after-free was identified in the nsDNSService::Init. This issue appears to manifest rarely during start-up...
CVE-2023-6861
The Mozilla Foundation Security Advisory describes this flaw as: The nsWindow::PickerOpenvoid method was susceptible to a heap buffer overflow when running in headless mode...
CVE-2023-6860
The Mozilla Foundation Security Advisory describes this flaw as: The VideoBridge allowed any content process to use textures produced by remote decoders. This could be abused to escape the sandbox...