CVE-2023-26441

Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources. An attacker with access to the database and a local or restricted network would be able to read arbitrary local file system resources that are accessible by the...

The vulnerability of the kernel of iOS operating systems, iPadOS, macOS Big Sur, macOS Monterey, watchOS, and macOS Ventura allows a perpetrator to execute arbitrary code.

The vulnerability of the kernel of iOS, iPadOS, macOS Big Sur, macOS Monterey, watchOS, and macOS Ventura lies in the reading of data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Google Chrome 缓冲区错误漏洞

Google Chrome is a web browser from the American company Google. Google Chrome suffers from a code execution vulnerability that is caused by out-of-bounds reads and writes in WebGL. An attacker can exploit this vulnerability to execute arbitrary code on the system or cause an application to crash...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to a missing allocation check in sftp server processing read requests. A malicious client can request up to 4GB SFTP reads, causing allocation of up to 4GB buffers, which is not being checked for failure. For...

CVE-2023-3603

A missing allocation check in sftp server processing read requests may cause a NULL dereference on low-memory conditions. The malicious client can request up to 4GB SFTP reads, causing allocation of up to 4GB buffers, which was not being checked for failure. This will likely crash the authenticat...

Amazon Linux AMI : kernel (ALAS-2023-1783)

The version of kernel installed on the remote host is prior to 4.14.320-168.534. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1783 advisory. A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and anonymous...

Heap overflow

All versions of GE Digital CIMPLICITY that are not adhering to SDG guidance and accepting documents from untrusted sources are vulnerable to memory corruption issues due to insufficient input validation, including issues such as out-of-bounds reads and writes, use-after-free, stack-based buffer...

CVE-2023-3463 GE Digital CIMPLICITY Heap-based Buffer Overflow

All versions of GE Digital CIMPLICITY that are not adhering to SDG guidance and accepting documents from untrusted sources are vulnerable to memory corruption issues due to insufficient input validation, including issues such as out-of-bounds reads and writes, use-after-free, stack-based buffer...

Important: kernel

Issue Overview: A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and anonymous sets in batch requests, which can lead to performing arbitrary reads and writes in kernel memory. This flaw allows a local user with CAPNETADMIN capability to crash o...

kernel: netfilter: use-after-free in nf_tables when processing batch requests can lead to privilege escalation

A use-after-free vulnerability was found in the Netfilter subsystem of the Linux kernel when processing batch requests to update nftables configuration. This vulnerability can be abused to perform arbitrary reads and writes in kernel memory. A local user with CAPNETADMIN capability could use this...

Improper restriction of XML external entity references (XXE) in XBRL data create application

Overview XBRL data create application provided by Financial Services Agency improperly restricts XML external entity references XXE CWE-611. Taku Toyama of NEC Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

Debian dla-3481 : libusrsctp-dev - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3481 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3481-1 [email protected] https://www.debian.org/lts/security/...

Oracle Essbase 安全漏洞

Oracle Essbase is an application from Oracle Corporation Oracle. It enables organizations to quickly generate insights from multidimensional data sets using what-if analysis and data visualization tools. A security vulnerability exists in Oracle Essbase that originates in the Security and...

Oracle JD Edwards 安全漏洞

Oracle JD Edwards Products is a fully integrated suite of Enterprise Resource Planning ERP applications from Oracle. The product provides application modules for financial management, project management, and asset lifecycle management. A security vulnerability exists in Oracle JD Edwards' JD...

The vulnerability of the seg6genl_sethmac function in the Linux operating system allows a hacker to disclose sensitive information that is protected by this function.

The vulnerability of the seg6genlsethmac function in the Linux operating system is related to reading beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to disclose protected information...

Linux kernel 缓冲区错误漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. An input validation error vulnerability exists in versions of Linux kernel prior to 6.3.9, which stems from ksmbd not validating the SMB request protocol ID, and can be exploit...

SUSE CVE-2023-3603

A missing allocation check in sftp server processing read requests may cause a NULL dereference on low-memory conditions. The malicious client can request up to 4GB SFTP reads, causing allocation of up to 4GB buffers, which was not being checked for failure. This will likely crash the authenticat...

UNISOC Chipsets 缓冲区错误漏洞

UNISOC Chipsets are chipsets from China's Zilight Spreadtrum UNISOC. A security vulnerability exists in some UNISOC products, which originates from a lack of boundary checking in the hciserver and may result in out-of-bounds reads. The following products are affected:...

OESA-2023-1413 kubernetes security update

Container cluster management. Security Fixes: Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are...

ROS-2-907

2.907 Vulnerability in Mozilla Thunderbird email client CVE-2021-29964, CVE-2021-29967 1. Vulnerability Description: CVE-2021-29964 A vulnerability in the Mozilla Thunderbird email client, is related to boundary conditions. Exploitation of the vulnerability could allow an attacker acting remotely...