582 matches found
CVE-2025-4919
CVE-2025-4919 describes an out-of-bounds read/write in JavaScript objects caused by confusing array index sizes, affecting Firefox including aliases (Firefox < 138.0.4, ESR < 128.10.1, ESR < 115.23.1) and Thunderbird (Thunderbird < 128.10.2; Thunderbird
CVE-2025-4919 Out-of-bounds access when optimizing linear sums
An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2...
CVE-2025-4919
An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2...
CVE-2025-4921
Removed by vendor...
Mozilla Firefox ESR < 128.10.1
The version of Firefox ESR installed on the remote Windows host is prior to 128.10.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-37 advisory. - An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index...
Mozilla Firefox < 138.0.4
The version of Firefox installed on the remote macOS or Mac OS X host is prior to 138.0.4. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-36 advisory. - An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array...
PT-2025-21811 · Mozilla +1 · Firefox +1
Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 138.0.4 Firefox ESR versions prior to 128.10.1 Description: An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. Recommendations: For Firefox versions...
Mozilla Firefox ESR < 115.23.1
The version of Firefox ESR installed on the remote Windows host is prior to 115.23.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-38 advisory. - An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index...
firefox -- out-of-bounds read/write
[email protected] reports: An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes...
The vulnerability of the access point loading function in Cisco IOS XE wireless local control devices allows a attacker to execute arbitrary commands.
The vulnerability of the Cisco IOS XE wireless local area network controller’s Access Point AP loading function is related to the presence of a strictly encrypted JSON Web Token JWT. Exploiting this vulnerability allows an attacker to execute arbitrary commands by sending specially crafted HTTPS...
jettison: parser crash by stackoverflow
A stack-based buffer overflow vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. This flaw allows an attacker to supply content that causes the parser to crash by writing outside the memory bounds if the parser is running on user-supplied input,...
Prototype Pollution
tarteaucitron.js is vulnerable to prototype pollution. The vulnerability is due to improper input validation in the addOrUpdate function within the file tarteaucitron.js, which allowed manipulation of JavaScript object prototypes...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the field label or handle during the import process from JSON. An attacker can execute arbitrary scripts in the context of the interface by inserting malicious content into these fields. Note: This is only...
MISP 安全漏洞
MISP is an open source software solution from MISP Open Source. The product is used to collect, store, distribute, and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in MISP versions prior to 2.4.193...
PYSEC-2025-83
A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. An attacker can exploit this vulnerability to read any local JSON file by sending a crafted POST request to the /read-examples endpoint...
Python JSON Logger 安全漏洞
Python JSON Logger is a JSON formatting tool for Python logs by the individual developer Nicholas Hairs. A security vulnerability exists in Python JSON Logger versions prior to 3.3.0, which stems from a missing dependency that could lead to remote code execution...
Distribution 安全漏洞
Distribution is Distribution's open source toolset for packaging, shipping, storing and delivering content. A security vulnerability exists in Distribution versions 3.0.0-beta.1 through 3.0.0-rc.2, which stems from a vulnerability that allows an attacker to inject an untrusted signing key into a...
Azure Linux 3.0 Security Update: cert-manager / containerized-data-importer / cri-o / dcos-cli / keda / kubernetes (CVE-2024-28180)
The version of cert-manager / containerized-data-importer / cri-o / dcos-cli / keda / kubernetes installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-28180 advisory. - Package jose aims to provide an...
Wazuh server remote code execution caused by an unsafe deserialization vulnerability.
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are serialized as JSON and...