GNU Binutils 安全漏洞

GNU Binutils objdump is a command-line tool in the toolset that is primarily used to analyze and display detailed information about binary files e.g. executables, target files, static libraries, etc.. A denial of service vulnerability exists in GNU Binutils objdump, which originates from the...

CVE-2022-47695

An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function bfdmachogetsyntheticsymtab in match-o.c...

CVE-2022-47695

An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function bfdmachogetsyntheticsymtab in match-o.c...

CVE-2022-47695: Uncontrolled Resource Consumption

An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function bfdmachogetsyntheticsymtab in match-o.c...

Security Bulletin: IBM Match 360 is vulnerable to a denial of service due to Apache Commons FileUpload in IBM WebSphere Application Server Liberty (CVE-2023-24998)

Summary IBM Match 360 is vulnerable due to vulnerability in the Apache Commons FileUpload library used by IBM WebSphere Application Server Liberty with the servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0 or servlet-6.0 feature enabled. This has been addressed in the remediation section...

Security Bulletin: IBM Match 360 is vulnerable to a denial of service due to Apache Commons FileUpload in IBM WebSphere Application Server Liberty (CVE-2023-24998)

Summary IBM Match 360 is vulnerable due to vulnerability in the Apache Commons FileUpload library used by IBM WebSphere Application Server Liberty with the servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0 or servlet-6.0 feature enabled. This has been addressed in the remediation section...

OSV-2023-673 Heap-buffer-overflow in match

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61268 Crash type: Heap-buffer-overflow READ 1 Crash state: match pcre2match8 pcre2fuzzsupport.c...

Moderate: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: GSS delegation too eager connection re-use CVE-2023-27536 curl: IDN wildcard match may lead to Improper Cerificate...

Moderate: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

PT-2023-26560 · Unknown · Cypress-Image-Snapshot

Name of the Vulnerable Software and Affected Versions: cypress-image-snapshot versions prior to 8.0.2 Description: The issue allows a user to pass a relative file path for the snapshot name, potentially reaching outside of the project directory into the machine running the test. This can be...

CVE-2023-3849

A vulnerability, which was classified as problematic, was found in mooSocial mooDating 1.2. Affected is an unknown function of the file /find-a-match of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this...

mooSocial mooDating 跨站脚本漏洞

mooSocial mooDating is a dating application from mooSocial. A cross-site scripting vulnerability exists in mooSocial mooDating version 1.2, which stems from a cross-site scripting XSS vulnerability in file/find-a-match...

CVE-2023-3849: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, was found in mooSocial mooDating 1.2. Affected is an unknown function of the file /find-a-match of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this...

PT-2023-26470 · Unknown · Moosocial Moodating

Name of the Vulnerable Software and Affected Versions: mooSocial mooDating version 1.2 Description: A problematic issue was found in the URL Handler component, specifically affecting an unknown function of the file /find-a-match. This issue leads to cross-site scripting and can be exploited...

Security Bulletin: IBM Match 360 is vulnerable to CVE-2019-10202 and CVE-2019-10172 for jackson-mapper-asl

Summary Match 360 is vulnerable to the following CVEs: CVE-CVE-2019-10202 and CVE-2019-10172 Vulnerability Details CVEID:CVE-2019-10202 DESCRIPTION: Red Hat JBoss Enterprise Application Platform EAP could allow a remote attacker to execute arbitrary code on the system, caused by improper...

Security Bulletin: IBM Match 360 is vulnerable to SnakeYaml's Constructor() class that not restrict types which can be instantiated during deserialization (CVE-2022-1471)

Summary SnakeYaml's Constructor class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict...

Security Bulletin: IBM Match 360 is vulnerable to Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes (CVE-2020-14422)

Summary Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or...

Security Bulletin: IBM Match 360 is vulnerable is vulnerable to server-side request forgery due to Apache CXF within IBM WebSphere Application Server Liberty (CVE-2022-46364)

Summary There is a vulnerability in IBM Match 360 due to Apache CXF library used by IBM WebSphere Application Server Liberty with the jaxws-2.2 feature enabled. This has been addressed. Vulnerability Details CVEID:CVE-2022-46364 DESCRIPTION: Apache CXF is vulnerable to server-side request forgery...

Security Bulletin: ICP Match 360 is vulnerable to the following CVEs

Summary ICP Match 360 is vulnerable to the following CVEs CVE-2022-3697, CVE-2022-41721, CVE-2022-41723, CVE-2015-3627, CVE-2022-23471, CVE-2023-25153, CVE-2023-25173 Vulnerability Details CVEID:CVE-2022-3697 DESCRIPTION: Ansible Collections Amazon AWS Collection could allow a remote attacker to...

Security Bulletin: IBM Match 360 is vulnerable to information disclosure due to Apache James MIME4J within IBM WebSphere Application Server Liberty (CVE-2022-45787)

Summary There is a vulnerability in the Apache James MIME4J library used by IBM WebSphere Application Server Liberty when the feature restfulWS-3.0 is enabled. This has been addressed. Vulnerability Details CVEID:CVE-2022-45787 DESCRIPTION: Apache James MIME4J could allow a local authenticated...