17016 matches found
CVE-2023-6004 Libssh: proxycommand/proxyjump features allow injection of malicious code through hostname
A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter...
GHSA-RG9Q-M8HV-XXR6 PaddlePaddle floating point exception in paddle.lerp
FPE in paddle.lerp in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service...
CVE-2024-0209 NULL Pointer Dereference in Wireshark
IEEE 1609.2 dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted capture file...
BELL-CVE-2023-51780
Bulletin has no description...
Gila CMS SQL Injection vulnerability
A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts via the 'userid' parameter after the login portal...
MC4WP < 4.9.10 - Unauthenticated Unpublished Form Preview
Description The plugin is vulnerable to unauthorized access of data due to a missing capability check on the 'listen' function, allowing unauthenticated attackers to preview unpublished forms...
CVE-2023-51652 OWASP.AntiSamy mXSS when preserving comments
OWASP AntiSamy .NET is a library for performing cleansing of HTML coming from untrusted sources. Prior to version 1.2.0, there is a potential for a mutation cross-site scripting mXSS vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerabilit...
BELL-CVE-2024-0193
Bulletin has no description...
MAL-2024-12 Malicious code in @serenity-web/common-assets (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1958105778b66cb3d83e65931c92543bf2777f57632f516f4b592808317e4b95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
OSV-2023-1375 Heap-buffer-overflow in IEC104Stats::processPacket
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65402 Crash type: Heap-buffer-overflow READ 1 Crash state: IEC104Stats::processPacket Flow::processIEC60870Packet NetworkInterface::processPacket...
CVE-2023-50110
TestLink through 1.9.20 allows type juggling for authentication bypass because === is not used...
CVE-2023-52267
ehttp 1.0.6 before 17405b9 has a simplelog.cpp log out-of-bounds-read during error logging for long strings...
CVE-2023-41543
SQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the component /sys/replicate/check...
CVE-2023-50570
An issue in the component IPAddressBitsDivision of IPAddress v5.1.0 leads to an infinite loop. This is disputed because an infinite loop occurs only for cases in which the developer supplies invalid arguments. The product is not intended to always halt for contrived inputs...
GHSA-JPVW-P8PR-9G2X Ansible symlink attack vulnerability
An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path...
GHSA-WPMX-564X-H2MH ewen-lbh/ffcss Late-Unicode normalization vulnerability
Summary The function lookupPreprocess is meant to apply some transformations to a string by disabling characters in the regex - .. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypass that validation and re-introduce all the characters in the regex - .. go ...
ewen-lbh/ffcss Late-Unicode normalization vulnerability
Summary The function lookupPreprocess is meant to apply some transformations to a string by disabling characters in the regex - .. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypass that validation and re-introduce all the characters in the regex - .. go ...
BELL-CVE-2023-6531
Bulletin has no description...
Potential CSV export data leak
Impact In ActiveAdmin versions prior to 2.12.0, a concurrency issue was found that could allow a malicious actor to be able to access potentially private data that belongs to another user. The bug affects the functionality to export data as CSV files, and was caused by a variable holding the...