MediaWiki cross-site scripting vulnerabilities

MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems. MediaWiki suffers from a cross-site scripting vulnerability that stems from BlockLogFormatter.php...

WooCommerce Stripe Payment Gateway < 7.4.1 - Subscriber+ Order Intent Update

The plugin does not properly restrict users from making a certain set of changes to other customers' orders. TODO: ADD link to Patchstack's post instead of H1 Affected functions: createpaymentintentajax updatepaymentintentajax saveupeappearanceajax updateorderstatusajax updatefailedorderajax As a...

JFinal security vulnerabilities

JFinal is a Java language based WEB + ORM open source framework. A security vulnerability exists in JFinal version v.4.9.08, which originated from allowing remote attackers to execute arbitrary code via template functions...

PT-2023-35884 · Uofs · Uofs

Name of the Vulnerable Software and Affected Versions: uofs affected versions not specified Description: The issue is related to a heap-buffer-overflow read, which occurs in the uofs component. Specifically, the crash happens in the pdfi find cff index and pdfi read cff font functions...

PT-2023-35882 · Git +1 · Ndpi

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow write crash. The crash involves functions such as ndpi search thrift tcp udp, check ndpi detection func, a...

F5 Networks BIG-IP : OpenSSL vulnerability (K000132946)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.10 / 16.1.4 / 17.1.0.1. It is, therefore, affected by a vulnerability as referenced in the K000132946 advisory. The public API function BIOnewNDEF is a helper function used for streaming ASN.1 data via a BIO. It is...

PT-2023-35877 · Git +1 · Ndpi

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 1 crash has been reported. The crash involves the functions ndpi search line, check ndpi detection func, and ndpi check flow...

Oracle Linux 9 : postgresql (ELSA-2023-3714)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-3714 advisory. 13.11-1.0.1 - Fixed postgresql port binding issue during bootup Orabug: 35420628 13.11-1 - Update to 13.11 - Resolves: 2207935 Tenable has extracted th...

MAL-2023-8357 Malicious code in arangodba (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 8a8f8299dc6c21b2441da8a56c195b046c05f65c0ab9b78f08aff27eb1611ac7 Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...

PT-2023-35873 · Git +1 · Poppler

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow crash. Technical details about the crash include the functions utf8ToUtf16 and utf8ToUtf16WithBom, as well...

CVE-2014-125106

Nanopb before 0.3.1 allows sizet overflows in pbdecbytes and pbdecstring...

CVE-2023-25645

There is a permission and access control vulnerability in some ZTE AndroidTV STBs. Due to improper permission settings, non-privileged application can perform functions that are protected with signature/privilege-level permissions. Exploitation of this vulnerability could clear personal data and...

CVE-2023-25645

There is a permission and access control vulnerability in some ZTE AndroidTV STBs. Due to improper permission settings, non-privileged application can perform functions that are protected with signature/privilege-level permissions. Exploitation of this vulnerability could clear personal data and...

PT-2023-20206

Name of the Vulnerable Software and Affected Versions ZTE AndroidTV STBs affected versions not specified Description The issue is related to improper permission settings, allowing non-privileged applications to perform protected functions. This could lead to the clearance of personal data and...

Upgraded Q -> 2 from #16 [1686928129422]

Judge has assessed an item in Issue 16 as 2 risk. The relevant finding follows: L-3 onlyOwner single point of failure Impact The onlyOwner role has a single point of failure and onlyOwner can use critical a few functions. Even if protocol admins/developers are not malicious there is still a chanc...

CVE-2023-21143

In multiple functions of multiple files, there is a possible way to make the device unusable due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2023-21143

In multiple functions of multiple files, there is a possible way to make the device unusable due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

Google Android security vulnerabilities

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that is caused by a privilege bypass in several functions of several files. An attacker can exploit this vulnerability to obtain sensitive information...

PT-2023-17936 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-11 through Android-13 Description: The issue is related to improper input validation in multiple functions across several files, which can cause a device to become unusable. This can lead to a local denial of service...

PT-2023-23987 · Code Projects · Supplier Management System

Name of the Vulnerable Software and Affected Versions: code-projects Supplier Management System version 1.0 Description: A critical issue has been found in the Picture Handler component of the Supplier Management System, affecting an unknown function of the file btn functions.php. This issue lead...