5902 matches found
CVE-2024-31441
DataEase (pre-1.18.19) is affected by an ARBITRARY FILE READ vulnerability due to lack of restrictions on ClickHouse connection parameters. An attacker can exploit certain malicious parameters to read arbitrary files. A fix is available in v1.18.19; upgrading to this version is recommended. Publi...
CVE-2024-31441 Arbitrary File Reading in DataEase
DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain malicious parameters to achieve arbitrary file reading. The vulnerability has been fixed in v1.18.19...
PT-2024-24078 · Dataease · Dataease
Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 1.18.19 Description: DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain...
PT-2024-19351 · Ibm · Ibm Txseries For Multiplatforms
Name of the Vulnerable Software and Affected Versions: IBM TXSeries for Multiplatforms version 8.2 Description: The issue allows web pages to be stored locally, which can then be read by another user on the system. Recommendations: For IBM TXSeries for Multiplatforms version 8.2, consider...
PT-2024-40764 · Git +1 · Ninja
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash caused by the use of an uninitialized value. The crash occurs in the following functions: Lexer::ReadToken,...
GHSA-5M98-QGG9-WH84 aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests
Summary An attacker can send a specially crafted POST multipart/form-data request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. Impact An attacker can stop the application from serving requests after sending a single...
CVE-2023-41824
An implicit intent vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read the calling phone number and calling data...
SUSE CVE-2023-52649
In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Avoid reading beyond LUT array When the floor LUT index drmfixp2intlutindex is the last index of the array the ceil LUT index will point to an entry beyond the array. Make sure we guard against it and use the value of t...
PT-2024-12988 · Motorola · Motorola Phone Calls
Name of the Vulnerable Software and Affected Versions: Motorola Phone Calls affected versions not specified Description: An implicit intent vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read the calling phone number and calling data...
PT-2024-26184 · Motorola · Motorola Enterprise Motodpms Provider
Name of the Vulnerable Software and Affected Versions: Motorola Enterprise MotoDpms Provider affected versions not specified Description: An improper export vulnerability was reported in the Motorola Enterprise MotoDpms Provider that could allow a local attacker to read local data. Recommendation...
ROS-20240503-01
A vulnerability in the Web Audio component of Microsoft Edge and Google Chrome browsers is related to memory usage after it has been freed. Exploitation of the vulnerability could allow an attacker acting remotely, execute arbitrary code A vulnerability in the Skia graphics library of Google Chro...
The vulnerability of the Microsoft ODBC Driver for SQL Server’s dynamic layout library, related to reading data beyond the buffer in memory, allows an attacker to execute arbitrary code.
The vulnerability of the Microsoft ODBC Driver for SQL Server dynamic loading library relates to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code remotely...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that originates from reading beyond the contents of the LUT array...
kernel: i2c: i801: Fix block process call transactions
In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Fix block process call transactions According to the Intel datasheets, software must reset the block buffer index twice for block process call transactions: once before writing the outgoing data to the buffer, and once...
QNAP Systems 多款产品路径遍历漏洞
QNAP Systems QuTScloud and others are products of China's Weilian Technology QNAP Systems.QNAP Systems QuTScloud is a cloud-optimized version of the QNAP NAS operating system.QNAP Systems QTS is an operating system for entry- to mid-range QNAP NAS use. QNAP Systems QuTS hero is an operating syste...
The vulnerability of the Font component (the default font used by Microsoft Edge and Google Chrome browsers) allows a perpetrator to gain access to potentially confidential information.
The vulnerability of the Font component the default font used by Microsoft Edge and Google Chrome browsers is related to memory-related reading operations. Exploiting this vulnerability can allow an attacker to gain access to potentially confidential information from a remote location...
The vulnerability of the planar_skip_plane_rle() function in the RDP client FreeRDP, which allows a hacker to disclose sensitive information
The vulnerability of the planarskipplanerle function in the FreeRDP client is related to reading beyond the memory boundaries. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information that is protected by this function...
The vulnerability of the Remote Access Connection Manager in Windows operating systems allows a hacker to disclose protected information.
The vulnerability of the Remote Access Connection Manager in Windows operating systems is related to reading data beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by security measures...
nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks
A flaw was found in Node.js due to a lack of safeguards on chunk extension bytes. The server may read an unbounded number of bytes from a single connection, which can allow an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and a denial of...