CVE-2023-45661 Wild address read in stbi__gif_load_next in stb_image

stbimage is a single file MIT licensed library for processing images. A crafted image file may trigger out of bounds memcpy read in stbigifloadnext. This happens because twoback points to a memory address lower than the start of the buffer out. This issue may be used to leak internal memory...

Squid DoS Vulnerability (GHSA-wgvf-q977-9xjg, SQUID-2024:3)

Squid is prone to a denial of service DoS vulnerability in ESI processing. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2023-35126

An out-of-bounds write vulnerability exists within the parsers for both the "DocumentViewStyles" and "DocumentEditStyles" streams of Ichitaro 2023 1.0.1.59372 when processing types 0x0000-0x0009 of a style record with the type 0x2008. A specially crafted document can cause memory corruption, whic...

USN-6438-1 dotnet6, dotnet7 vulnerabilities

Kevin Jones discovered that .NET did not properly process certain X.509 certificates. An attacker could possibly use this issue to cause a denial of service. CVE-2023-36799 It was discovered that the .NET Kestrel web server did not properly handle HTTP/2 requests. A remote attacker could possibly...

CVE-2023-35126

CVE-2023-35126 affects JustSystems Ichitaro 2023 where the vulnerability resides in the parsing of the DocumentViewStyles and DocumentEditStyles streams (record type 0x2008). The root cause is an out-of-bounds index into a 6-element lv_objects array used during readStyleType(2008), which enables ...

SchedMD Slurm Security Vulnerability

SchedMD Slurm is an open source and highly scalable cluster management and job scheduling system for large and small Linux clusters from SchedMD, Inc. SchedMD Slurm suffers from a security vulnerability that stems from file system processing that could lead to a race condition. An attacker could...

The vulnerability of the Core server component of Oracle WebLogic Server allows a hacker to execute arbitrary code.

The vulnerability of the Core server component of Oracle WebLogic Server is related to errors in processing input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely by injecting specially crafted messages via T3 and IIOP protocols...

Debian: Security Advisory (DSA-5529-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2023-28743 · Xnsoft · Xnsoft Nconvert

Name of the Vulnerable Software and Affected Versions: XNSoft Nconvert version 7.136 Description: The issue is related to a Buffer Overflow, which can be triggered by a crafted image file, leading to a User Mode Write AV. This could result in a Denial of Service DoS or potentially allow code...

[SECURITY] [DSA 5529-1] slurm-wlm security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5529-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 17, 2023 https://www.debian.org/security/faq -...

USN-6433-1 ghostscript vulnerability

It was discovered that Ghostscript incorrectly handled certain PDF documents. If a user or automated system were tricked into opening a specially crafted PDF file, a remote attacker could use this issue to execute arbitrary code...

bind: stack exhaustion in control channel code may lead to DoS

A flaw was found in the Bind package. The code that processes control channel messages sent to named calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size. Depending on the environment, this may cause the packet-parsing code...

The vulnerability of the Apache Oozie data processing automation system, Azure HDInsight, allows attackers to escalate their privileges.

The vulnerability of the Apache Oozie data processing automation system, used in Azure HDInsight analytics services, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to enhance their privileges remotely...

The vulnerability of the Suricata intrusion detection and prevention system arises from the operation going beyond the buffer boundaries in memory. This allows attackers to circumvent security restrictions and execute the TCP Reset attack.

The vulnerability of the Suricata intrusion detection and prevention system lies in the fact that the operation escapes the buffer in memory due to insufficient checking of the values of the FIN, SYN, and ACK parameters during packet processing. Exploiting this vulnerability allows a remote...

The vulnerability of the DICOM Viewer Pro software in processing medical images allows a hacker to execute arbitrary code by writing outside the buffer.

The vulnerability of the DICOM Viewer Pro software for viewing and processing medical images is related to writing outside the buffer. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

PT-2023-6373 · Wago · Wago

Name of the Vulnerable Software and Affected Versions: Wago products affected versions not specified Description: The issue allows a remote attacker with administrative privileges to access files through an undocumented local file inclusion. This access is logged in a different log file than...

CVE-2022-32755

IBM Security Directory Server 6.4.0 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 228505...

The software’s vulnerability regarding centralized device management by Fortinet FortiManager and the FortiAnalyzer network firewall, related to an error in processing user-controlled authentication keys, allows a perpetrator to access confidential data.

The vulnerability of the software for centralized device management by Fortinet’s FortiManager and FortiAnalyzer lies in a processing error related to authentication keys, which are controlled by users. Exploiting this vulnerability allows an attacker to gain access to confidential data remotely...

The vulnerability of the console-based graphic editor ImageMagick lies in its reliance on memory after it is freed, allowing a hacker to trigger a service failure.

The vulnerability of the console-based graphic editor ImageMagick is related to the use of memory after it is freed during the processing of BMP files. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the Windows Message Queuing system allows a hacker to execute arbitrary code.

The vulnerability of Windows’ Message Queuing system is related to errors in processing input data. Exploiting this vulnerability can allow an attacker to execute arbitrary code...