CVE-2024-24579 Tar path traversal in stereoscope when processing OCI tar archives

stereoscope is a go library for processing container images and simulating a squash filesystem. Prior to version 0.0.1, it is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary director...

BIT-LIFERAY-2022-42124

ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through fix pack 18, 7.3 before update 4, and DXP 7.4 GA allows remote attackers to consume an excessive amount of server resources via a crafted payload injected in...

BIT-LIFERAY-2023-33944

Cross-site scripting XSS vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a container type layout fragment's UR...

PT-2024-20466 · Unknown · Stereoscope

Name of the Vulnerable Software and Affected Versions: stereoscope versions prior to 0.0.1 Description: It is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary directory. This issue is...

Malicious code in yoga-layout-bf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d9b59bfda9900fe733c84e49fb2751b2e66ecd904895deedb4b591f80be5685d The OpenSSF Package Analysis project identified 'yoga-layout-bf' @ 2.1.0 npm as malicious. It is considered malicious because: - The package...

CVE-2024-20710

Adobe Substance 3D Stager versions 2.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in tha...

The vulnerability of the APDU Frame Layout Handler component in Hitachi Energy RTU500 CMU series programmable logic controllers allows a attacker to trigger a service failure.

The vulnerability of the APDU Frame Layout Handler component in Hitachi Energy RTU500 CMU series programmable logic controllers is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to trigger service failures by sending...

PT-2024-5263 · Qualcomm · Qualcomm Embedded Platform

Name of the Vulnerable Software and Affected Versions: Qualcomm embedded platform software affected versions not specified Description: The issue is related to information disclosure when Address Space Layout Randomization ASLR relocates certain portions in virtual address space as one chunk...

PT-2023-30871 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS versions 8.5.13 and earlier Concrete CMS versions 9.0.0 through 9.2.2 Description: The issue allows an admin to add a stored XSS payload via the Layout Preset name, potentially affecting user interactions with the system...

CVE-2023-48650

Concrete CMS before 8.5.14 and 9 before 9.2.3 is vulnerable to an admin adding a stored XSS payload via the Layout Preset name...

CVE-2023-48650

Concrete CMS before 8.5.14 and 9 before 9.2.3 is vulnerable to an admin adding a stored XSS payload via the Layout Preset name...

CVE-2023-48650

Concrete CMS before 8.5.14 and 9 before 9.2.3 is vulnerable to an admin adding a stored XSS payload via the Layout Preset name...

CVE-2023-48650: Improper Neutralization of Input During Web Page Generation

Concrete CMS before 8.5.14 and 9 before 9.2.3 is vulnerable to an admin adding a stored XSS payload via the Layout Preset name...

The vulnerability of the Adobe Experience Manager (AEM) content and media data management system, related to the lack of measures taken to protect the website structure, allows a perpetrator to execute arbitrary code.

The vulnerability of the Adobe Experience Manager AEM content and media data management system is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

Adobe InDesign Code Issues Vulnerabilities

Adobe InDesign is a set of layout and editing applications from the American company Audobee Adobe. Adobe InDesign has a security vulnerability that can be exploited by attackers to cause a denial of service...

Huawei EulerOS: Security Advisory for harfbuzz (EulerOS-SA-2023-3432)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of Adobe InDesign’s computer layout automation software, related to the issue of operations going beyond buffer boundaries in memory, allows attackers to gain unauthorized access to protected information.

The vulnerability of Adobe InDesign’s computer layout automation tool is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information by opening a specially created file...

Malicious code in primeng-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e5db0733e63e7005d9395916c8fe50701981527ec8471164b58588a92937388a The OpenSSF Package Analysis project identified 'primeng-layout' @ 8.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8695 Malicious code in primeng-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e5db0733e63e7005d9395916c8fe50701981527ec8471164b58588a92937388a The OpenSSF Package Analysis project identified 'primeng-layout' @ 8.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2023-46247 Vyper has incorrect storage layout for contracts containing large arrays

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. Contracts containing large arrays might underallocate the number of slots they need by 1. Prior to v0.3.8, the calculation to determine how many slots a storage variable needed used math.ceiltype.sizeinbytes / 32. T...