Security update for mozjs115

This update for mozjs115 fixes the following issues: CVE-2024-45490: Fixed negative len for XMLParseBuffer in embedded expat bnc1230036 CVE-2024-45491: Fixed integer overflow in dtdCopy in embedded expat bnc1230037 CVE-2024-45492: Fixed integer overflow in function nextScaffoldPart in embedded...

PT-2024-7129 · D Link · D-Link Dir-619L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L B1 version 2.06 Description: A critical vulnerability was found in the function formDeviceReboot of the file /goform/formDeviceReboot. The manipulation of the argument next page leads to a buffer overflow, allowing a remote...

D-Link DIR-619L 安全漏洞

The D-Link DIR-619L is a wireless router designed for home and small office environments, utilizing the IEEE 802.11n standard with a maximum transmission rate of 300Mbps. The D-Link DIR-619L suffers from a buffer overflow vulnerability, which originates from the nextpage parameter of the...

D-Link DIR-605L 安全漏洞

The AUO DIR-605L is a wireless router from China's AUO D-Link. The AUO DIR-605L suffers from a buffer overflow vulnerability that originates from the nextpage parameter of the formDeviceReboot function in the /goform/formDeviceReboot page that fails to correctly validate the length and size of th...

CVE-2024-47530

Scout is a web-based visualizer for VCF-files. Open redirect vulnerability allows performing phishing attacks on users by redirecting them to malicious page. /login API endpoint is vulnerable to open redirect attack via next parameter due to absence of sanitization logic. Additionally, due to lac...

PT-2024-32644

Name of the Vulnerable Software and Affected Versions Scout versions prior to 4.89 Description The issue allows for open redirect attacks, enabling phishing attacks on users by redirecting them to malicious pages. The /login API endpoint is vulnerable due to the absence of sanitization logic in t...

CVE-2024-47530: URL Redirection to Untrusted Site

Scout is a web-based visualizer for VCF-files. Open redirect vulnerability allows performing phishing attacks on users by redirecting them to malicious page. /login API endpoint is vulnerable to open redirect attack via next parameter due to absence of sanitization logic. Additionally, due to lac...

net-snmp: A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference.

A flaw was found in net-snmp. A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference issue...

GHSA-VRCX-GX3G-J3H8 Heap-based Buffer Overflow in sqlite-vec

sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow via the npytokennext function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted file...

CVE-2024-46488

sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow via the npytokennext function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted file...

CVE-2024-8275

The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribehasnextevent' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

Vulnerability of the nextScaffoldPart() function (xmlparse.c) in the libexpat XML parsing library, which allows an attacker to cause a service failure or execute arbitrary code.

The vulnerability of the nextScaffoldPart function in the libexpat XML parsing library is related to integer overflow. Exploiting this vulnerability could allow an attacker to cause service failures or execute arbitrary code...

snappy-java: Unchecked chunk length leads to DoS

A flaw was found in Snappy-java's fileSnappyInputStream hasNextChunk function, which does not sufficiently evaluate input bytes before beginning operations. This issue could allow an attacker to send malicious input to trigger an out of memory error that crashes the program, resulting in a denial...

Weak Password Vulnerability in Next-Generation Firewall SG-6000 of Shanshi Netcom Technology (Beijing) Co.

Ltd. is a company specializing in technological innovation in the field of network security. A weak password vulnerability exists in the SG-6000 next-generation firewall of Shanshi Netcom Technology Beijing Co. Ltd, which can be exploited by attackers to obtain sensitive information...

1ocalendar (1.0.0), @alpaca-headless/alpaca-headless-nextjs (>=1.0.13, <=1.0.27) +151 more potentially affected by CVE-2024-46982 via next (>=13.5.1, <=13.5.6)

next NPM version =13.5.1, =1.0.13, =1.0.7, =1.0.0, =1.0.5, =0.1.0, =24.4.0, =0.2.7, =5.4.2, =1.0.0, =0.0.1, =0.0.14 and more Source cves: CVE-2024-46982 Source advisory: OSV:GHSA-GP8F-8M3G-QVJ9...

CLSA-2024-1726608591 expat: Fix of 3 CVEs

CVE-2024-45490: Reject negative length for XMLParseBuffer in xmlparse.c - CVE-2024-45491: Detect integer overflow in dtdCopy on 32-bit platforms - CVE-2024-45492: Detect integer overflow in nextScaffoldPart on 32-bit platforms...

CLSA-2024-1726608017 Fix CVE(s): CVE-2024-45491, CVE-2024-45492

SECURITY UPDATE: Avoid integer overflow on 32 bits systems - debian/patches/CVE-2024-45491.patch: fix dtdCopy in xmlparse.c - CVE-2024-45491 SECURITY UPDATE: Avoid integer overflow on 32 bits systems - debian/patches/CVE-2024-45492.patch: fix nextScaffoldPart in xmlparse.c - CVE-2024-45492...

Concrete CMS Stored XSS in the "Next&Previous Nav" block

Concrete CMS versions 9.0.0 to 9.3.4 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block. A rogue administrator could add a malicious payload by executing it in the browsers of targeted users. Since the "Next&Previous Nav" block output was not sufficiently sanitized, th...

GHSA-XMXJ-V2Q8-8QX6 Concrete CMS Stored XSS in the "Next&Previous Nav" block

Concrete CMS versions 9.0.0 to 9.3.4 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block. A rogue administrator could add a malicious payload by executing it in the browsers of targeted users. Since the "Next&Previous Nav" block output was not sufficiently sanitized, th...

CVE-2024-8661

Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block. A rogue administrator could add a malicious payload by executing it in the browsers of targeted users. The Concrete CMS Security Team gave this vulnerability a CVSS v4 score of 4.6...