269 matches found
CVE-2024-8768 Vllm: a completions api request with an empty prompt will crash the vllm api server.
A flaw was found in the vLLM library. A completions API request with an empty prompt will crash the vLLM API server, resulting in a denial of service...
The vulnerability of the `stbi_set_flip_vertically_on_load` component in the C/C++ Libstb library involves reading data beyond the allowable buffer boundaries. This allows attackers to access confidential data and also trigger a denial-of-service attack.
The vulnerability of the stbisetflipverticallyonload component in the C/C++ Libstb library is related to reading data beyond the allowable buffer size. Exploiting this vulnerability can allow an attacker to access confidential data, as well as cause service interruptions through the use of a...
CVE-2024-38108
Azure Stack Hub Spoofing Vulnerability...
The vulnerability of the APDFL library used by the 3D JT and JT2Go viewing tools, as well as the Teamcenter Visualization lifecycle management system, allows a perpetrator to execute arbitrary code.
The vulnerability of the APDFL library used by the 3D JT and JT2Go viewing tools, as well as the Teamcenter Visualization lifecycle management system, relates to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow attackers to execute arbitrary code...
golang: archive/zip: Incorrect handling of certain ZIP files
A flaw was found in Golang. The ZIP implementation of the Go language archive/zip library behaves differently than the rest of the ZIP file format implementations. When handling ZIP files with a corrupted central directory record, the library skips over the invalid record and processes the next...
containers/image: digest type does not guarantee valid type
A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks...
PT-2024-5734 · Gtk +9 · Gtk +9
Name of the Vulnerable Software and Affected Versions: GTK versions prior to the fixed version Description: A flaw was found in the GTK library, allowing for library injection from the current working directory under certain conditions. This could potentially enable an attacker to elevate their...
golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges.
A flaw was found in the Golang crypto/tls standard library. In previous versions, the package was vulnerable to a Timing Side Channel attack by observing the time it took for RSA-based TLS key exchanges, which was not constant. This flaw allows a malicious user to gather information from the...
UBUNTU-CVE-2024-3772
Regular expression denial of service in Pydanic 2.4.0, 1.10.13 allows remote attackers to cause denial of service via a crafted email string...
AZL-39851 CVE-2024-22189 affecting package coredns for versions less than 1.11.1-6
quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of NEWCONNECTIONID frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a...
The vulnerability of the zlog_rule_s class in the logging library allows a violator to execute arbitrary code.
The vulnerability of the zlogrules class in the zlog logging library is related to the execution of operations outside the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
parsson: Denial of Service due to large number parsing
A flaw was found in Eclipse Parsson library when processing untrusted source content. This issue may cause a Denial of Service DoS due to built-in support for parsing numbers with a large scale, and some cases where processing a large number may take much more time than expected...
The vulnerability of the Jose4j JWT library, related to the incorrect implementation of the PBES2 algorithm when processing the p2c parameter, allows a violator to trigger a service failure.
The vulnerability of the Jose4j JWT library is related to the incorrect implementation of the PBES2 algorithm when processing the p2c parameter. Exploiting this vulnerability can allow an attacker who operates remotely to cause a service failure...
libfastjson: integer overflow and out-of-bounds write via a large JSON file
A flaw was found in json-c. In printbufmemappend, certain crafted values can overflow the memory allowing an attacker to write past the memory boundary. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...
golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges.
A flaw was found in the Golang crypto/tls standard library. In previous versions, the package was vulnerable to a Timing Side Channel attack by observing the time it took for RSA-based TLS key exchanges, which was not constant. This flaw allows a malicious user to gather information from the...
libfastjson: integer overflow and out-of-bounds write via a large JSON file
A flaw was found in json-c. In printbufmemappend, certain crafted values can overflow the memory allowing an attacker to write past the memory boundary. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...
urllib3: Request body not stripped after redirect from 303 status changes request method to GET
A flaw was found in urllib3, an HTTP client library for Python. urllib3 doesn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303, after changing the method in a request from one that could accept a request body such as POST to GET, as is required by HTTP...
ALPINE-CVE-2023-43788
A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer function. This flaw allows a local attacker to trigger an out-of-bounds read error and read the contents of memory on the system...
libwebp: Heap buffer overflow in WebP Codec
A heap-based buffer flaw was found in the way libwebp, a library used to process "WebP" image format data, processes certain specially formatted WebP images. An attacker could use this flaw to crash or execute remotely arbitrary code in an application such as a web browser compiled with this...
PT-2023-27150 · Unknown +1 · Routinator +1
Name of the Vulnerable Software and Affected Versions: Routinator versions up to and including 0.12.1 Description: The issue is caused by insufficient input checking in the bcder library, which may lead to a crash when trying to parse certain malformed RPKI objects. Recommendations: For versions ...