7628 matches found
PT-2023-36793
Уязвимость функции io ring exit work модуля io uring/io uring.c интерфейса асинхронного ввода/вывода ядра операционной системы Linux связана с ошибками инициализации. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...
diablo2.io Cross Site Scripting vulnerability OBB-3414920
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
GO-2023-1826 Signature validation bypass in github.com/moov-io/signedxml
Signature validation canonicalizes the input XML document before validating the signature. Parsing the uncanonicalized and canonicalized forms can produce different results. An attacker can exploit this variation to bypass signature validation. Users of signature validation must only parse the...
AZL-27112 CVE-2023-29403 affecting package golang for versions less than 1.20.7-1
On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I...
AZL-37368 CVE-2023-29403 affecting package golang for versions less than 1.21.6-1
On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I...
Amazon Linux 2 : apache-commons-io (ALAS-2023-2059)
The version of apache-commons-io installed on the remote host is prior to 2.4-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2059 advisory. In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like...
samantha.dialogify.io Cross Site Scripting vulnerability OBB-3386941
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
diablo2.io Cross Site Scripting vulnerability OBB-3380508
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
USN-6133-1 linux-intel-iotg vulnerabilities
It was discovered that the Traffic-Control Index TCINDEX implementation in the Linux kernel did not properly perform filter deactivation in some situations. A local attacker could possibly use this to gain elevated privileges. Please note that with the fix for this CVE, kernel support for the...
qemu security update
15:4.2.1-26.el7 - migration: check magic value for deciding the mapping of channels manish.mishra Orabug: 34735462 - io: Add support for MSGPEEK for socket channel manish.mishra Orabug: 34735462 - migration: Move channel setup out of postcopytryrecover Peter Xu Orabug: 34735462 - vdpa: commit all...
Memory corruption
mp4v2 v2.1.3 was discovered to contain a memory leak via MP4File::ReadString at mp4fileio.cpp...
Medium: apache-commons-io
Issue Overview: In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above thus...
MP4v2 安全漏洞
MP4v2 is a library for creating, modifying and reading MP4 files by the individual developer enzo1982. A security vulnerability exists in MP4v2 version v2.1.3, which stems from a memory leak in MP4File::ReadString in mp4fileio.cpp...
UBUNTU-CVE-2023-32695
socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3...
CVE-2023-2898
There is a null-pointer-dereference flaw found in f2fswriteendio in fs/f2fs/data.c in the Linux kernel. This flaw allows a local privileged user to cause a denial of service problem...
html inputs of type password recorded in plaintext when converted to text inputs
Impact Highlight may record passwords on customer deployments when a password html input is switched to type="text" via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates type="password" inputs. A customer may assume that switching to type="text"...
maven bug fix and enhancement update
An update is available for plexus-interpolation, httpcomponents-core, maven-wagon, maven, google-guice, jsoup, jansi, apache-commons-io, apache-commons-lang3, maven-shared-utils, plexus-utils, plexus-classworlds, jakarta-annotations, httpcomponents-client, apache-commons-codec, plexus-cipher,...
Security Bulletin: A vulnerability in Etcd-io could affect IBM CICS TX Advanced [CVE-2021-28235]
Summary CVE-2021-28235 related to etcd package could affect IBM CICS TX Advanced. IBM CICS TX Advanced has addressed the applicable CVE. CVE-2021-28235 Vulnerability Details CVEID:CVE-2021-28235 DESCRIPTION: Etcd-io could allow a remote attacker to gain elevated privileges on the system, caused b...
Security Bulletin: A vulnerability in Etcd-io could affect IBM CICS TX Standard [CVE-2021-28235]
Summary CVE-2021-28235 related to etcd package could affect IBM CICS TX Standard. IBM CICS TX Standard has addressed the applicable CVE. CVE-2021-28235 Vulnerability Details CVEID:CVE-2021-28235 DESCRIPTION: Etcd-io could allow a remote attacker to gain elevated privileges on the system, caused b...
Amazon Linux 2022 : golang, golang-bin, golang-misc (ALAS2022-2022-128)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-128 advisory. A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating chunked encoding. This issue could allow request smuggling, but only if combined with an...