13097 matches found
CVE-2023-0703
Type confusion in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via UI interactions. Chromium security severity: Medium...
CVE-2023-0696
Type confusion in V8 in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
CVE-2022-31249 [RANCHER] OS command injection in Rancher and Fleet
A Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in wrangler of SUSE Rancher allows remote attackers to inject commands in the underlying host via crafted commands passed to Wrangler. This issue affects: SUSE Rancher wrangler version 0.7.3 a...
X.509 Name Constraints Read Buffer Overflow
A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate...
GHSA-8CFG-VX93-JVXW vulnerabilities
Vulnerabilities for packages: gostatsd, spark-operator, kubeflow-pipelines, newrelic-nri-statsd...
Deserialization Of Untrusted Data
hutool-core is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to the readObjectFromXml function in XmlUtil.java which doesn't properly decode the object when parsing the XML string, allowing an attacker to inject and execute malicious commands...
CVE-2023-25193 vulnerabilities
Vulnerabilities for packages: openjdk...
CVE-2023-23087
An issue was found in MojoJson v1.2.3 allows attackers to execute arbitary code via the destroy function...
CVE-2022-25916
Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scan' function...
ASB-A-244154558
In run of ChooseTypeAndAccountActivity.java, there is a possible escalation of privilege due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
MAL-2023-892 Malicious code in tohe-doc-resources (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17a9a9c63d20d34ca8cd59f2c43090e89223718888b73e20c38ba84477ee6d02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
The vulnerability of the 3D Builder software for designing and preparing objects for 3D printing lies in insufficient validation of input data, allowing a hacker to execute arbitrary code.
The vulnerability of the 3D Builder software for designing and preparing objects for 3D printing is related to insufficient verification of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created file...
SUSE-SU-2023:0215-1 Security update for apache2-mod_auth_openidc
This update for apache2-modauthopenidc fixes the following issues: - CVE-2022-23527: Fixed open redirect in oidcvalidateredirecturl using tab character bsc1206441. - CVE-2021-39191: Fixed open redirect issue in targetlinkuri parameter bsc1190223...
MAL-2023-988 Malicious code in yandex-meteo-flow (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad598f1585a297ca8d20439b26fa25afb526a1f69cbdde3832e457b6daa6cf83 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
GHSA-3CHW-8JQ2-W769 Froxlor contains Unchecked Error Condition
Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10...
DLA-3292-1 sofia-sip - security update
Bulletin has no description...
GHSA-6325-6G32-7P35 flash_tool Gem for Ruby File Download Handling Arbitrary Command Execution
flashtool Gem for Ruby contains a flaw that is triggered during the handling of downloaded files that contain shell characters. With a specially crafted file, a context-dependent attacker can execute arbitrary commands...
GHSA-9WRR-4R9V-26XC CSRF vulnerability in Jenkins Keycloak Authentication Plugin
A cross-site request forgery CSRF vulnerability in Jenkins Keycloak Authentication Plugin 2.3.0 and earlier allows attackers to trick users into logging in to the attacker's account...
CVE-2023-0284
Improper Input Validation of LDAP user IDs in Tribe29 Checkmk allows attackers that can control LDAP user IDs to manipulate files on the server. Checkmk = 2.1.0p19, Checkmk = 2.0.0p32, and all versions of Checkmk 1.6.0 EOL are affected...