Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception due to an uncaught std::outofrange exception in PCLPointCloud2::at. An attacker can cause the application to crash by submitting specially crafted PLY files. Remediation There is no fixed version for pcl. References -...

CLSA-2024-1732197150 Fix of 20 CVEs

Update to 8u432-ga fixing a number of CVEs - CVE-2024-20918: missing array range check in C1 compiler leads to out-of-bounds access - CVE-2024-20919: unverified bytecode execution because of the flaw in JVM class file verifier - CVE-2024-20921: optimization issue of loop range check in IfNode and...

PT-2024-33556 · Oracle · Oracle-Sidecar

Name of the Vulnerable Software and Affected Versions: oracle-sidecar versions 0.347.0 through 0.543.0 Description: The issue concerns SQL injections in multiple endpoints. An unauthenticated attacker can compromise data. Recommendations: For versions 0.347.0 through 0.543.0, upgrade the affected...

TOTOLINK EX200 安全漏洞

TOTOLINK EX200 is a 2.4G wireless N range extender from China's Gion Electronics TOTOLINK. A security vulnerability exists in the TOTOLINK EX200 ssd parameter handling, which can be exploited by remote attackers to submit a special request that can be used to execute arbitrary commands in the...

PT-2024-35739 · Pcl +3 · Pcl +3

Name of the Vulnerable Software and Affected Versions: PCL version 1.14.1 Description: The issue occurs when parsing certain malformed PLY files, causing PCL to crash due to an uncaught std::out of range exception in PCLPointCloud2::at. This could potentially be exploited to cause a...

SUSE CVE-2024-53062

In the Linux kernel, the following vulnerability has been resolved: media: mgb4: protect driver against spectre Frequency range is set from sysfs via frequencyrangestore, being vulnerable to spectre, as reported by smatch: drivers/media/pci/mgb4/mgb4cmt.c:231 mgb4cmtsetvinfreqrange warn: potentia...

DEBIAN-CVE-2024-52762

A cross-site scripting XSS vulnerability in the component /master/header.php of Ganglia-web v3.73 to v3.76 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the "tz" parameter...

DEBIAN-CVE-2024-53062

In the Linux kernel, the following vulnerability has been resolved: media: mgb4: protect driver against spectre Frequency range is set from sysfs via frequencyrangestore, being vulnerable to spectre, as reported by smatch: drivers/media/pci/mgb4/mgb4cmt.c:231 mgb4cmtsetvinfreqrange warn: potentia...

UBUNTU-CVE-2024-53062

In the Linux kernel, the following vulnerability has been resolved: media: mgb4: protect driver against spectre Frequency range is set from sysfs via frequencyrangestore, being vulnerable to spectre, as reported by smatch: drivers/media/pci/mgb4/mgb4cmt.c:231 mgb4cmtsetvinfreqrange warn: potentia...

CVE-2024-53062 media: mgb4: protect driver against spectre

In the Linux kernel, the following vulnerability has been resolved: media: mgb4: protect driver against spectre Frequency range is set from sysfs via frequencyrangestore, being vulnerable to spectre, as reported by smatch: drivers/media/pci/mgb4/mgb4cmt.c:231 mgb4cmtsetvinfreqrange warn: potentia...

RLSA-2024:9548 Important: openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fixes:...

PT-2024-35040 · Unknown · Gonzalo Geraldo Adventure Bucket List

Name of the Vulnerable Software and Affected Versions: Gonzalo Geraldo Adventure Bucket List versions 1.0.0 through 1.0.9 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for DOM-Based XSS, which can ...

PT-2024-34832 · Unknown · Manage User Columns

Name of the Vulnerable Software and Affected Versions: Manage User Columns versions 1.0.0 through 1.0.5 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the use...

PT-2024-33182 · Unknown · Officeweb365

Name of the Vulnerable Software and Affected Versions: OfficeWeb365 versions 7.18.23.0 through 8.6.1.0 Description: The issue allows a remote attacker to execute arbitrary code via the "pw/savedraw" component. This enables the attacker to upload files that can lead to code execution, potentially...

UBUNTU-CVE-2024-52303

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each...

CLSA-2024-1731956942 Fix CVE(s): CVE-2020-25666, CVE-2020-27764, CVE-2020-27776

SECURITY UPDATE: Undefined behavior in the form of values outside the range of type unsigned long - debian/patches/CVE-2020-27764-and-CVE-2020-27776.patch: Fix outside the range of representable values of type unsigned long - CVE-2020-27764 - CVE-2020-27776 SECURITY UPDATE: Integer overflow in...

CLSA-2024-1731956848 ImageMagick: Fix of 3 CVEs

CVE-2020-27751: fix shift exponent that is too large for 64-bit type at magick/quantum-export.c - CVE-2020-27757: fix outside the range of representable values of type 'unsigned long long' bug at magick/quantum-private.h - CVE-2020-27768: fix outside the range of representable values of type...

@1023-ventures/vega-core (>=0.5.0, <=0.6.2), @copart/ops-tool-kit (>=1.11.4-alpha.2, <=1.12.13-alpha.1) +44 more potentially affected by CVE-2024-11023 via firebase (>=10.0.0, <=10.8.1)

firebase NPM version =10.0.0, =0.5.0, =1.11.4-alpha.2, =0.0.3-3, =0.0.7-20, =0.0.1-dev.1, =1.0.0, =1.0.0, =0.5.0, =0.0.1, =8.18.0, =1.0.10, =1.0.9, =0.0.2, =1.0.39, =1.0.24, =1.0.128 and more Source cves: CVE-2024-11023 Source advisory: OSV:GHSA-3WF4-68GX-MPH8...

CVE-2024-42391

Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space...

CVE-2024-42389

Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space...