9641 matches found
PT-2023-35902 · Git +1 · Serenity
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow read issue is identified, potentially causing a crash. The crash occurs in the Gfx::InputStreamer::read u24 function, which is...
PT-2025-40230
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The gs usb device driver in the Linux kernel has an issue where the timestamp counter initialization can lead to a NULL pointer dereference. This occurs if the driver is unloaded or...
CVE-2023-3482
When Firefox is configured to block storage of all cookies, it was still possible to store data in localstorage by using an iframe with a source of 'about:blank'. This could have led to malicious websites storing tracking data without permission. This vulnerability affects Firefox 115...
CVE-2023-21193
In VideoFrame of VideoFrame.h, there is a possible abort due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-233006499...
libdwarf:fuzz_set_frame_all: Crash in _dwarf_exec_frame_instr
Project: https://github.com/davea42/libdwarf-code.git Detailed Report: https://oss-fuzz.com/testcase?key=5757752673435648 Project: libdwarf Fuzzing Engine: libFuzzer Fuzz Target: fuzzsetframeall Job Type: libfuzzerasanlibdwarf Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...
Backstage 代码注入漏洞
Backstage is a software application. Backstage is an open platform for building developer portals. A code injection vulnerability exists in Backstage versions prior to 1.15.0 that originates from allowing an attacker to execute remote code on a backend instance of the base frame folder...
PT-2023-35876
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN READ. The crash state involves several functions, including dwarf exec frame instr, dwarf get fde info for ...
libdwarf:fuzz_set_frame_all: Crash in _dwarf_exec_frame_instr
Project: https://github.com/davea42/libdwarf-code.git Detailed Report: https://oss-fuzz.com/testcase?key=6613067367317504 Project: libdwarf Fuzzing Engine: afl Fuzz Target: fuzzsetframeall Job Type: aflasanlibdwarf Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x605ffde00049 Crash...
CVE-2023-35846
VirtualSquare picoTCP aka PicoTCP-NG through 2.1 does not check the transport layer length in a frame before performing port filtering...
ffmpeg:ffmpeg_BSF_EVC_FRAME_MERGE_fuzzer: Segv on unknown address in ff_evc_parse_nal_unit
Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=6240076603195392 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegBSFEVCFRAMEMERGEfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State:...
Severe Vulnerabilities Reported in Microsoft Azure Bastion and Container Registry
Two "dangerous" security vulnerabilities have been disclosed in Microsoft Azure Bastion and Azure Container Registry that could have been exploited to carry out cross-site scripting XSS attacks. "The vulnerabilities allowed unauthorized access to the victim's session within the compromised Azure...
CVE-2023-24895
A flaw was found in dotnet. This issue can allow remote code execution when WPF is handling XAML Frame elements...
.NET Core Multiple Vulnerabilities - Windows
.NET Core is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:microsoft:asp.netcore";...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. The Linux kernel suffers from a buffer overflow vulnerability that stems from a flaw in the frame buffer console fbcon that fails to properly check fbconsetfont when provided...
Denial of service via HTTP/2 HEADERS frames padding
A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.2. It is fixed in 1.20.0 and later releases. This vulnerability is caused by a logica...
CVE-2023-34238
Gatsby is a free and open source framework based on React. The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability in the "file-code-frame" and "original-stack-frame" paths, exposed when running the Gatsby develop server "gatsby develop". Any file in...
CVE-2023-3140
Missing HTTP headers X-Frame-Options, Content-Security-Policy in KNIME Business Hub before 1.4.0 has left users vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into clicking on an actionable item, such as a...
CVE-2023-3140
CVE-2023-3140 affects KNIME Business Hub prior to 1.4.0. The root cause is a missing HTTP security header set (X-Frame-Options and Content-Security-Policy), enabling clickjacking where an attacker can embed the app in a malicious page and trick users into actions on the original site. Impact deta...
PT-2023-23297 · Knime · Knime Business Hub
Name of the Vulnerable Software and Affected Versions: KNIME Business Hub versions prior to 1.4.0 Description: The issue is related to missing HTTP headers, specifically X-Frame-Options and Content-Security-Policy, in KNIME Business Hub. This omission leaves users vulnerable to clickjacking...
CVE-2023-3140: Improper Restriction of Rendered UI Layers or Frames
Missing HTTP headers X-Frame-Options, Content-Security-Policy in KNIME Business Hub before 1.4.0 has left users vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into clicking on an actionable item, such as a...