MuPDF Number Error Vulnerability

MuPDF is MuPDF open source a free and open source software library written in C . It is used to render pages as bitmaps, but also provides support for other operations such as searching and listing directories and links. A numeric error vulnerability exists in MuPDF version 1.23.4 due to a floati...

CVE-2023-51104: Divide By Zero

A floating point exception divide-by-zero vulnerability was discovered in Artifex MuPDF 1.23.4 in function pnmbinaryreadimage of load-pnm.c when span equals zero...

CVE-2023-51106

A floating point exception divide-by-zero vulnerability was discovered in mupdf 1.23.4 in function pnmbinaryreadimage of load-pnm.c when fzcolorspacen returns zero...

CVE-2023-51106

CVE-2023-51106 affects MuPDF 1.23.4 and is caused by a division-by-zero in pnm_binary_read_image() within load-pnm.c when fz_colorspace_n returns zero. The primary impact stated across connected documents is denial of service via remote execution considerations, with various advisories noting the...

CVE-2023-51105

A floating point exception divide-by-zero vulnerability was discovered in Artifex MuPDF 1.23.4 in function bmpdecompressrle4 of load-bmp.c...

PT-2023-13354 · Apache · Apache Axis

Name of the Vulnerable Software and Affected Versions: RWS WorldServer versions prior to 11.7.3 Description: An issue was discovered that allows an authenticated, remote attacker to perform a blind SSRF attack using the ws-legacy/load dtd?system id= endpoint to deploy JSP code to the Apache Axis...

CVE-2023-24609

Matrix SSL 4.x through 4.6.0 and Rambus TLS Toolkit have a length-subtraction integer overflow for Client Hello Pre-Shared Key extension parsing in the TLS 1.3 server. An attacked device calculates an SHA-2 hash over at least 65 KB in RAM. With a large number of crafted TLS messages, the CPU...

MatrixSSL Security Vulnerability

Inside Secure MatrixSSL is an embedded, open-source SSLv3 stack designed for small applications and devices from Inside Secure, France. A security vulnerability exists in Rambus TLS Toolkit, MatrixSSL versions 4.x through 4.6.0, which stems from a length-subtracting integer overflow in the parsin...

WordPress Ajax Load More Plugin <= 6.1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Ajax Load More Type Plugin Vulnerable versions = 6.1.0.1 Fixed in 6.2.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-50874 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 14a974ab0c99 Credits Ngô Thiên An ancorn from VNPT-VCI...

PT-2023-19708 · Rambus · Rambus Tls Toolkit

Name of the Vulnerable Software and Affected Versions: Matrix SSL versions 4.x through 4.6.0 Rambus TLS Toolkit affected versions not specified Description: The issue is related to a length-subtraction integer overflow for Client Hello Pre-Shared Key extension parsing in the TLS 1.3 server. This...

CVE-2023-24609

Matrix SSL 4.x through 4.6.0 and Rambus TLS Toolkit have a length-subtraction integer overflow for Client Hello Pre-Shared Key extension parsing in the TLS 1.3 server. An attacked device calculates an SHA-2 hash over at least 65 KB in RAM. With a large number of crafted TLS messages, the CPU...

PT-2023-8384

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A Null pointer dereference problem was found in the ida free function in the lib/idr.c file of the Linux Kernel. This issue may allow an attacker using this library to cause a denial of...

The vulnerability of Microsoft Edge browsers lies in the lack of tag blocking during website loading, which allows attackers to circumvent security restrictions.

The vulnerability of Microsoft Edge relates to the absence of tag blocking during website loading. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions by loading malicious web pages or files...

keycloak: offline session token DoS

An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens 500,000 users with each having at least 2 saved sessions. If an attacker creates two or more user sessions and then open the "consents" tab of th...

PT-2023-29280 · Plutosvg · Plutosvg

Name of the Vulnerable Software and Affected Versions: PlutoSVG versions prior to commit 336c02997277a1888e6ccbbbe674551a0582e5c4 Description: The issue is related to an integer overflow in the plutosvg load from memory component. No information is provided about the estimated number of potential...

grafana: data source proxy race condition

A flaw was found in grafana. This issue occurs when sending an API call to the /ds/query or public dashboard query endpoint that has mixed queries, such as having two or more distinct data sources in one API call. As a result, the Grafana instance will crash. Currently, the only feature that uses...

curl security update

7.29.0-59.0.3.el79.2 - load CA certificates even with --insecure Orabug: 32836997 - Fix TFTP small blocksize heap buffer overflow https://curl.haxx.se/docs/CVE-2019-5482.htmlCVE-2019-5482Orabug: 30568724 - Security Fixes OraBug: 28939992 - CVE-2016-8615 cookie injection for other servers...

ALPINE-CVE-2023-34320

Cortex-A77 cores r0p0 and r1p0 are affected by erratum 1508412 where software, under certain circumstances, could deadlock a core due to the execution of either a load to device or non-cacheable memory, and either a store exclusive or register read of the Physical Address Register PAREL1 in close...

DEBIAN-CVE-2023-34320

Cortex-A77 cores r0p0 and r1p0 are affected by erratum 1508412 where software, under certain circumstances, could deadlock a core due to the execution of either a load to device or non-cacheable memory, and either a store exclusive or register read of the Physical Address Register PAREL1 in close...

CVE-2023-34320

Cortex-A77 cores r0p0 and r1p0 are affected by erratum 1508412 where software, under certain circumstances, could deadlock a core due to the execution of either a load to device or non-cacheable memory, and either a store exclusive or register read of the Physical Address Register PAREL1 in close...