Code injection

Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could have applied an incorrect classification to a newly created property or link...

Palantir Security Breach

Palantir is a data platform from US-based Palantir that reimagines how people use data by removing the barriers between back-end data management and front-end data analysis. A security vulnerability exists in Palantir Gotham that stems from the presence of a front-end UI error that causes newly...

plone.rest vulnerable to Denial of Service when ++api++ is used many times

Impact When the ++api++ traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches Patches will be released in plone.rest 2.0.1 and 3.0.1. Series 1.x is not affected. Workarounds In your frontend web server nginx, Apac...

GHSA-H6RP-MPRM-XGCQ plone.rest vulnerable to Denial of Service when ++api++ is used many times

Impact When the ++api++ traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches Patches will be released in plone.rest 2.0.1 and 3.0.1. Series 1.x is not affected. Workarounds In your frontend web server nginx, Apac...

CVE-2023-42457

plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the ++api++ traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less...

CVE-2023-42457 plone.rest vulnerable to Denial of Service when ++api++ is used many times

plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the ++api++ traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less...

Contao Cross-site Scripting vulnerabililty

Contao 3.x before 3.5.32 allows Cross-site Scripting XSS via the unsubscribe module in the frontend newsletter extension...

GHSA-MPG7-2RX9-H5QP Contao Cross-site Scripting vulnerabililty

Contao 3.x before 3.5.32 allows Cross-site Scripting XSS via the unsubscribe module in the frontend newsletter extension...

CVE-2018-5478

Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension...

CVE-2018-5478

Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension...

MAL-2023-8108 Malicious code in surf-sharekit-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 449f014291c34fa4bc1a855658d8ff0b9fe4788e1986e2410d3dc82ac8e50abb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in purplebricks-frontend-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f8044c661c6223ef46436635423b8c74bbebf2796ae2252435a5592288dceca7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8105 Malicious code in purplebricks-frontend-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f8044c661c6223ef46436635423b8c74bbebf2796ae2252435a5592288dceca7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-3301

A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an assertion and cause a denial of service...

CVE-2023-3301

A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an assertion and cause a denial of service...

DEBIAN-CVE-2023-3301

A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an assertion and cause a denial of service...

The vulnerability in the `drivers/media/usb/ttusb-dec/ttusb_dec.c` component of the Linux kernel allows a attacker to perform a “denial-of-service” attack.

The vulnerability of the drivers/media/usb/ttusb-dec/ttusbdec.c component in the Linux operating system is related to a memory leak due to the absence of the dvbfrontenddetach function being called. Exploiting this vulnerability can allow an attacker to perform a type of “denial-of-service” attac...

An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event wait_event_interruptible is called; the condition is dvb_frontend_test_event(feprivevents). In dvb_frontend_test_event down(&fepriv->sem) is called. However wait_event_interruptible would put the process to sleep and down(&fepriv->sem) may block the process.

...

Malicious code in frontend-effect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f99fca2bf58d400b4cf4e469118f0ff61967c8a4e29d0ec247501cf57a978428 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-7955 Malicious code in frontend-effect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f99fca2bf58d400b4cf4e469118f0ff61967c8a4e29d0ec247501cf57a978428 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...