Arbitrary File Upload

Gradio is vulnerable to an Arbitrary File Upload vulnerability. The vulnerability is due to the /upload interface endpoint via /tmp directory. The attacker can exploit this by uploading arbitrary files, potentially leading to unauthorized access or execution of malicious code...

DLA-3611-1 inetutils - security update

Bulletin has no description...

BELL-CVE-2023-45322

Bulletin has no description...

BELL-CVE-2023-44387

Bulletin has no description...

OPENSUSE-SU-2023:0292-1 Security update for chromium

This update for chromium fixes the following issues: Chromium 117.0.5938.149: CVE-2023-5346: Type Confusion in V8 boo1215924...

BELL-CVE-2023-43804

Bulletin has no description...

SA-2023-08-08-CVE-2023-35083

SECURITY ADVISORY 08-08-2023 Product Affected: Ivanti Endpoint Manager A vulnerability was recently discovered for EPM 2022 SU3 and all previous versions. We have a Hotfix available to remediate this vulnerability that can be found by going to CVE-2023-35083 Full details. Please log into the...

SUSE-SU-2023:3949-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Mozilla Firefox was updated to 115.3.1 ESR, fixing a security issue: MFSA 2023-44 bsc1215814 CVE-2023-5217: Fixed a heap buffer overflow in libvpx...

Cross-Site Scripting (XSS)

html/template is vulnerable to Cross-Site Scripting XSS attacks. The vulnerability exists because the package does not properly handle HTML-like "" comment tokens, nor hashbang "!" comment tokens, in...

BELL-CVE-2023-5344

Bulletin has no description...

OSV-2023-940 Heap-buffer-overflow in _dwarf_memcpy_swap_bytes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62842 Crash type: Heap-buffer-overflow READ 1 Crash state: dwarfmemcpyswapbytes fillinuniarch64 dwarfmachosetup...

ASB-A-294779649

Bulletin has no description...

ASB-A-273874525

In buildreadmultirsp of gattsr.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote proximal/adjacent code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

PUB-A-261492822

Bulletin has no description...

ASB-A-274058082

In androidviewInputDevicecreate of androidviewInputDevice.cpp, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-5207 Execution with Unnecessary Privileges in GitLab

A vulnerability was discovered in GitLab CE and EE affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. An authenticated attacker could perform arbitrary pipeline execution under the context of another user...

CVE-2023-2233 Missing Authorization in GitLab

An improper authorization issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.2.8, all versions starting from 16.3 before 16.3.5 and all versions starting from 16.4 before 16.4.1. It allows a project reporter to leak the owner's Sentry instance projects...

CVE-2023-5176

Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox 118, Firefox ESR...

sing-box vulnerable to improper authentication in the SOCKS inbound

Impact This vulnerability allows specially crafted requests to bypass authentication, affecting all SOCKS inbounds with user authentication. Patches Update to sing-box 1.4.5 or 1.5.0-rc.5 and later versions. Workarounds Don't expose the SOCKS5 inbound to insecure environments...

CVE-2022-4244 Codehaus-plexus: directory traversal

A flaw was found in codeplex-codehaus. A directory traversal attack also known as path traversal aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash ../" sequences and their variations or by using absolute file paths, it may be possib...