PT-2024-4665 · Python +9 · Python +9

Name of the Vulnerable Software and Affected Versions: Python versions prior to 3.10.14 Python versions prior to 3.11.9 Python versions prior to 3.12.3 Python versions prior to 3.13.0a5 Description: A defect was discovered in the Python “ssl” module where there is a memory race condition with the...

January 9, 2024—KB5034129 (OS Build 20348.2227)

None None...

CentOS 8 : openssl (CESA-2023:7877)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:7877 advisory. - Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHcheck, DHcheck...

GTKWave LXT2 num_time_table_entries out-of-bounds write vulnerability

Talos Vulnerability Report TALOS-2023-1819 GTKWave LXT2 numtimetableentries out-of-bounds write vulnerability January 8, 2024 CVE Number CVE-2023-34436 SUMMARY An out-of-bounds write vulnerability exists in the LXT2 numtimetableentries functionality of GTKWave 3.3.115. A specially crafted .lxt2...

The Treasury.sol contract changes the address for the different manager contract in one function call.

Lines of code Vulnerability details Impact In a case where either one of the manager addresses the tokenomics, depositiory or dispenser contracts are compromised or deprecated, attempting to replace the compromised manager contract address necessitates an overall replacement of all the other...

Easy Social Feed < 6.5.3 - Subscriber+ Settings Update

Description The plugin is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized actions, such as modifying the plugin's...

PT-2024-14520 · Unknown · Paddlepaddle

Name of the Vulnerable Software and Affected Versions: PaddlePaddle versions prior to 2.6.0 Description: The issue is related to a flaw in paddle.argmin and paddle.argmax that can cause a runtime crash and a denial of service. This flaw can lead to a denial of service. Recommendations: For versio...

PT-2024-13352

Name of the Vulnerable Software and Affected Versions Plotly plotly.js versions prior to 2.25.2 Description The issue concerns plot API calls having a risk of proto being polluted in expandObjectPaths or nestedProperty. This could potentially lead to security issues, although specific details abo...

VulnCheck KEV: CVE-2022-2314

The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site...

PT-2023-35680 · Git +1 · Libavc

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read error. Technical details about the crash include the functions ih264d get bits h264, ih264d parse fgc...

CVE-2023-38021

An issue was discovered in Fortanix EnclaveOS Confidential Computing Manager CCM Platform before 3.32 for Intel SGX. Lack of pointer-alignment validation logic in entry functions allows a local attacker to access unauthorized information. This relates to the enclaveecall function and system call...

PT-2023-26248 · Fortanix +1 · Fortanix Enclaveos Confidential Computing Manager (Ccm) Platform +1

Name of the Vulnerable Software and Affected Versions: Fortanix EnclaveOS Confidential Computing Manager CCM Platform versions prior to 3.32 for Intel SGX Description: An issue was discovered in the Fortanix EnclaveOS Confidential Computing Manager CCM Platform, which relates to a lack of...

PT-2023-26250 · Intel · Intel Sgx

Name of the Vulnerable Software and Affected Versions: SCONE Confidential Computing Platform versions prior to 5.8.0 Description: An issue was discovered in the SCONE Confidential Computing Platform, where the lack of pointer-alignment logic in scone dispatch and other entry functions allows a...

PT-2023-35676 · Git +1 · Htslib

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 1 crash has been reported. The crash involves the following functions: process one read, cram encode container, and cram flus...

SUSE-SU-2023:4974-1 Security update for distribution

This update for distribution fixes the following issues: distribution was updated to 2.8.3 bsc1216491: Pass BUILDTAGS argument to go build Enable Go build tags reference: replace deprecated function SplitHostname Dont parse errors as JSON unless Content-Type is set to JSON update to go 1.20.8 Set...

WordPress Plugin PlusCaptcha Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2023-35670 · Git +1 · Quickjs

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read error. Technical details include a crash state involving js free function def, js parse function decl...

The vulnerability in the Dapr Dashboard’s web interface relates to the lack of authentication for critical functions, allowing attackers to influence the confidentiality of protected information.

The vulnerability in the Dapr Dashboard’s web interface is related to the lack of authentication for critical functions. Exploiting this vulnerability could allow a malicious actor to influence the confidentiality of the protected information...

Bidders can bid at previous auction reserve price by frontrunning the setter transactions

Lines of code Vulnerability details Impact The AuctionHouse.settleCurrentAndCreateNewAuction can frontrun the setter functions such as setCreatorRateBps, setMinCreatorRateBps, setEntropyRateBps, setTimeBuffer, setMinBidIncrementPercentage & setReservePrice. As soon as the current auction ends, an...

postgresql: Memory disclosure in aggregate function calls

A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes,...