Merative Merge DICOM Toolkit 安全漏洞

The Merative Merge DICOM Toolkit is a comprehensive API from Merative that complies with the latest DICOM standards. A security vulnerability exists in Merative Merge DICOM Toolkit C/C++ versions v5.6.0 through v.5.17.0, which stems from an unhandled exception that can be caused when using the...

PT-2024-20171 · Merge · Merge Dicom Toolkit C/C++

Name of the Vulnerable Software and Affected Versions: Merge DICOM Toolkit C/C++ versions ≤5.17.0 Description: The issue is related to the use of an externally-controlled format string vulnerability in the Merge DICOM Toolkit C/C++ on Windows. When the MC Open Association function is used to open...

PT-2024-20170 · Unknown · Merge Dicom Toolkit C/C++

Name of the Vulnerable Software and Affected Versions: Merge DICOM Toolkit C/C++ affected versions not specified Description: The issue arises from the use of a deprecated function, MC XML To Message, which can lead to memory access violations when processing malformed DICOM XML files. This occur...

PT-2024-20169 · Unknown · Merge Dicom Toolkit C/C++

Name of the Vulnerable Software and Affected Versions: Merge DICOM Toolkit C/C++ affected versions not specified Description: The issue is related to an out-of-bounds read when the MC Open File function is used to read malformed DICOM data, potentially resulting in over-reading of the memory buff...

CVE-2024-23914: Use of Externally-Controlled Format String

Use of Externally-Controlled Format String vulnerability in Merge DICOM Toolkit C/C++ on Windows. When MCOpenAssociation function is used to open DICOM Association and gets DICOM Application Context Name with illegal characters, it might result in an unhandled exception...

CVE-2024-23913: Undefined Security Weakness

Use of Out-of-range Pointer Offset vulnerability in Merge DICOM Toolkit C/C++ on Windows. When deprecated MCXMLToMessage function is used to read a malformed DICOM XML file, it might result in memory access violation...

CVE-2024-23912: Out-of-bounds Read

Out-of-bounds Read vulnerability in Merge DICOM Toolkit C/C++ on Windows. When MCOpenFile function is used to read a malformed DICOM data, it might result in over-reading memory buffer and could cause memory access violation...

glibc: potential use-after-free in gaih_inet()

A flaw has been identified in glibc. In an uncommon situation, the gaihinet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with...

PT-2024-27227

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.9 Description The issue is related to a deadlock regression in the Linux kernel's wifi: iwlwifi module, which was introduced with the LED merge in version 6.9. The deadlock occurs when all worker threads are bu...

RHEL 6 / 7 : rh-mysql57-mysql (RHSA-2018:3655)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3655 advisory. MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon, mysqld, and many client programs. The...

GHSA-RR59-H6RH-V84V Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE

Improper Input Validation vulnerability in Apache Zeppelin SAP. This issue affects Apache Zeppelin SAP: from 0.8.0 before 0.11.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance ...

Prototype Poisoning

Overview mysql2 is a mostly API compatible with mysqljs and supports majority of features. Affected versions of this package are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in textparser.js and...

Prototype Pollution

Overview dset is an A tiny 161B utility for safely writing deep Object values! Affected versions of this package are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the...

Prototype Pollution

web3-utils is vulnerable to Prototype Pollution. The vulnerability is due to insecure recursive merge via the utility functions format and mergeDeep, allowing an attacker to manipulate an object's prototype by passing specially crafted input to these functions...

GHSA-87QP-7CW8-8Q9C Duplicate Advisory: web3-utils Prototype Pollution vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2g4c-8fpm-c46v. This link is maintained to preserve external references. Original Description Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions forma...

Duplicate Advisory: web3-utils Prototype Pollution vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2g4c-8fpm-c46v. This link is maintained to preserve external references. Original Description Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions forma...

CVE-2024-21505

Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive merge. An attacker can manipulate an object's prototype, potentially leading to the alteration of the behavior of all objects inheriting...

CVE-2024-21505

CVE-2024-21505 affects the web3-utils package: versions prior to 4.2.1 are vulnerable to a Prototype Pollution issue in the recursive merge via the helper functions format and mergeDeep . An attacker can alter an object’s prototype, potentially changing behavior of all objects inheriting from it....

CVE-2024-21505

Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive merge. An attacker can manipulate an object's prototype, potentially leading to the alteration of the behavior of all objects inheriting...

CVE-2024-21505: Improperly Controlled Modification of Object Prototype Attributes

Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive merge. An attacker can manipulate an object's prototype, potentially leading to the alteration of the behavior of all objects inheriting...