Important: libssh2

Issue Overview: An issue was discovered in function libssh2packetadd in libssh2 1.10.0 allows attackers to access out of bounds memory. CVE-2020-22218 Affected Packages: libssh2 Issue Correction: Run yum update libssh2 or yum update --advisory ALAS-2023-1834 to update your system. New Packages:...

Use After Free

libgpac.so is vulnerable for Use After Free. The vulnerability is due to a lack of memory location validation in ctx-reftkw within the ctx-tracks array in the mp4muxconfigurepid function of src/filters/muxisom.c...

PT-2023-19083

Name of the Vulnerable Software and Affected Versions Electron versions 22 through 23 Description A Content-Security-Policy that disables eval is not respected in renderers with sandbox disabled, allowing methods like eval and new Function to be used unexpectedly, which can result in an expanded...

CVE-2023-23623: Always-Incorrect Control Flow Implementation

Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. A Content-Security-Policy that disables eval, specifically setting a script-src directive and not providing unsafe-eval in that directive, is not respected in renderers that have sandb...

DEBIAN-CVE-2023-41633

Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/fileutil.c...

CVE-2023-41633

Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/fileutil.c...

CVE-2023-41633

Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/fileutil.c...

CVE-2023-41633

Catdoc v0.95 contains a NULL pointer dereference in the xls2csv component (src/fileutil.c). This CVE (CVE-2023-41633) is supported by multiple sources (NVD, Red Hat, OSV, etc.). The vulnerability can cause crashes (availability impact), but exploitation details and a vendor patch are not provided...

CVE-2023-41633: NULL Pointer Dereference

Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/fileutil.c...

Integer overflow

Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.6.0 and prior are vulnerable to integer overflow in consumecount of src/gnuv2/cplus-dem.c. The overflow check is valid logic but, is missing the modulus if the block once compiled. The compiler sees this block...

CVE-2023-40022: Integer Overflow or Wraparound

Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.6.0 and prior are vulnerable to integer overflow in consumecount of src/gnuv2/cplus-dem.c. The overflow check is valid logic but, is missing the modulus if the block once compiled. The compiler sees this block...

PT-2023-11547

Name of the Vulnerable Software and Affected Versions Dnsmasq versions up to and including 2.80 Description An issue was discovered in the /src/helper.c file of Dnsmasq, allowing attackers to cause a denial of service via the create helper function. Recommendations For Dnsmasq versions up to and...

CVE-2023-39743

lrzip-next LZMA v23.01 was discovered to contain an access violation via the component /bz3decodeblock src/libbz3.c...

CVE-2023-39743: Improper Access Control

lrzip-next LZMA v23.01 was discovered to contain an access violation via the component /bz3decodeblock src/libbz3.c...

Medium: cups

Issue Overview: OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service DoS attack. A buffer overflow vulnerability in the function formatlogline could allow remote attackers...

SUSE CVE-2023-3180

A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtiocryptohandlesymreq. There is no check for the value of srclen and dstlen in virtiocryptosymophelper, potentially leading to a heap buffer overflow when the two values differ...

AZL-31817 CVE-2023-3180 affecting package qemu for versions less than 6.2.0-23

A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtiocryptohandlesymreq. There is no check for the value of srclen and dstlen in virtiocryptosymophelper, potentially leading to a heap buffer overflow when the two values differ...

CVE-2022-43711: Improper Neutralization of Input During Web Page Generation

Interactive Forms IAF in GX Software XperienCentral versions 10.29.1 until 10.33.0 was vulnerable to cross site scripting attacks XSS because the CSP header uses eval in the script-src...

CVE-2023-37613

A cross-site scripting XSS vulnerability in Assembly Software Trialworks v11.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the asset src parameter...

CVE-2023-37613

A cross-site scripting XSS vulnerability in Assembly Software Trialworks v11.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the asset src parameter...