CVE-2024-54137

A flaw was found in the liboqs library. A correctness error has been identified in the reference implementation of the HQC key encapsulation mechanism. Due to an indexing error, part of the secret key is incorrectly treated as non-secret data. This issue results in an incorrect shared secret valu...

CVE-2024-10074

in OpenHarmony v4.1.1 and prior versions allow a local attacker cause the common permission is upgraded to root through use after free...

The vulnerability of the MSASN1.dll library file, WifiAutoInstallDriver.exe, a microprogramming system for wireless USB adapters of TOTOLINK A600UB, allows a hacker to execute arbitrary code.

The vulnerability of the MSASN1.dll library file, WifiAutoInstallDriver.exe, which is part of the wireless USB adapter software for TOTOLINK A600UB, is related to improper checking of integrity values. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

chromium-browser: Use after free in ANGLE

There's a flaw in the Angle package where processing maliciously crafted web content may lead to a use-after-free. A remote attacker may leverage that to exploit heap corruption related bugs, such as crashing the application or remote code execution...

The vulnerability of the w3dtk.dll library in Autodesk Navisworks allows a perpetrator to execute arbitrary code.

The vulnerability of the w3dtk.dll library in Autodesk Navisworks software is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

BELL-CVE-2024-50090

Bulletin has no description...

Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library

A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host...

CVE-2024-10469

VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users...

Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library

A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host...

CVE-2021-20277

...

AZL-50070 CVE-2024-9341 affecting package podman for versions less than 5.6.1-2

A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host...

urllib3: proxy-authorization request header is not stripped during cross-origin redirects

A flaw was found in urllib3, an HTTP client library for Python. In certain configurations, urllib3 does not treat the Proxy-Authorization HTTP header as one carrying authentication material. This issue results in not stripping the header on cross-origin redirects...

go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion

A flaw was found in the go/build/constraint package of the Golang standard library. Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion...

CVE-2024-8768 Vllm: a completions api request with an empty prompt will crash the vllm api server.

A flaw was found in the vLLM library. A completions API request with an empty prompt will crash the vLLM API server, resulting in a denial of service...

The vulnerability of the `stbi_set_flip_vertically_on_load` component in the C/C++ Libstb library involves reading data beyond the allowable buffer boundaries. This allows attackers to access confidential data and also trigger a denial-of-service attack.

The vulnerability of the stbisetflipverticallyonload component in the C/C++ Libstb library is related to reading data beyond the allowable buffer size. Exploiting this vulnerability can allow an attacker to access confidential data, as well as cause service interruptions through the use of a...

CVE-2024-38108

Azure Stack Hub Spoofing Vulnerability...

The vulnerability of the APDFL library used by the 3D JT and JT2Go viewing tools, as well as the Teamcenter Visualization lifecycle management system, allows a perpetrator to execute arbitrary code.

The vulnerability of the APDFL library used by the 3D JT and JT2Go viewing tools, as well as the Teamcenter Visualization lifecycle management system, relates to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow attackers to execute arbitrary code...

golang: archive/zip: Incorrect handling of certain ZIP files

A flaw was found in Golang. The ZIP implementation of the Go language archive/zip library behaves differently than the rest of the ZIP file format implementations. When handling ZIP files with a corrupted central directory record, the library skips over the invalid record and processes the next...

containers/image: digest type does not guarantee valid type

A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks...

PT-2024-5734 · Gtk +9 · Gtk +9

Name of the Vulnerable Software and Affected Versions: GTK versions prior to the fixed version Description: A flaw was found in the GTK library, allowing for library injection from the current working directory under certain conditions. This could potentially enable an attacker to elevate their...