13034 matches found
GHSA-M88M-CRR9-JVQQ OpenRefine vulnerable to zip slip in project import
Impact A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution if a user can be convinced to import it. Patches The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as...
OpenRefine vulnerable to zip slip in project import
Impact A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution if a user can be convinced to import it. Patches The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as...
Implementing an ISO-compliant threat intelligence program
Implementing a threat intelligence program that meets the definition of threat intelligence control as described in ISO/IEC 27002:2022 -- a set of standards set forth by the International Organization for Standardization -- is not onerous. The ISO/IEC 27002 standard describes a non-exhaustive lis...
CVE-2023-37266
creationtimestamp| type| source ---|---|--- 2023-07-18 00:45:24+00:00| seen| https://t.me/cibsecurity/66856 2023-10-17 17:35:31+00:00| seen| https://t.me/KomunitiSiber/945 2023-10-17 17:40:39+00:00| seen| Telegram/DhBuM5h9ZembCAXJLb1SO10emtONhvTPWBycf14R0dULg...
UBUNTU-CVE-2023-37476
OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of...
Double free
OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of...
CVE-2023-37476
OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of...
CVE-2023-37476
OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of...
CVE-2023-37476 Zip slip in OpenRefine
OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of...
CVE-2023-2929
creationtimestamp| type| source ---|---|--- 2023-07-17 17:00:38+00:00| published-proof-of-concept| Telegram/RBRi8qpCx4FDT1MstKiy3fEU-jZkUVZjocmEPEaKaF-qVfw 2023-08-22 16:41:34+00:00| published-proof-of-concept| Telegram/uHyw4ugSuJPumXrlGG37OT5kzW1eR2BbK60BwDinWaA64kA 2024-08-16 08:08:27+00:00|...
PT-2023-5893 · Unknown +2 · Openrefine +2
Name of the Vulnerable Software and Affected Versions: OpenRefine versions prior to 3.7.4 Description: The issue is related to a Zip Slip vulnerability in OpenRefine, which can be exploited by a specially crafted malicious OpenRefine project tar file. This can lead to arbitrary code execution in...
CVE-2023-34127
creationtimestamp| type| source ---|---|--- 2023-07-13 07:42:12+00:00| seen| https://t.me/cibsecurity/66610 2023-08-22 12:27:06+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/8892 2023-09-08 10:11:37+00:00| seen|...
CVE-2023-3643
creationtimestamp| type| source ---|---|--- 2023-07-12 22:25:46+00:00| seen| https://t.me/cibsecurity/66602 2026-03-03 10:01:07+00:00| seen| https://bsky.app/profile/exploitdb-bot.bsky.social/post/3mg5j65cbdr2v 2026-03-03 10:06:05+00:00| seen|...
c-ares: Insufficient randomness in generation of DNS query IDs
A vulnerability was found in c-ares. This issue occurs when /dev/urandom or RtlGenRandom are unavailable, c-ares will use rand to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand, so it will generate predictable output...
CVE-2023-36884
creationtimestamp| type| source ---|---|--- 2023-07-11 21:56:22+00:00| seen| https://t.me/ctinow/123163 2023-07-12 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1062 2023-07-12 09:42:06+00:00| seen| https://t.me/kasperskyb2b/746 2023-07-12 09:56:39+00:00| exploited|...
CVE-2023-32046
creationtimestamp| type| source ---|---|--- 2023-07-11 18:10:02+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2023-07-12 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1062 2023-07-12 09:42:06+00:00| seen| https://t.me/kasperskyb2b/746 2023-07-12 14:02:05+00:00|...
CVE-2023-2255
creationtimestamp| type| source ---|---|--- 2023-07-11 13:12:49+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/8650 2023-07-13 14:40:41+00:00| published-proof-of-concept| https://t.me/crackcodes/3875 2023-07-13 14:42:25+00:00| published-proof-of-concept|...
golang: regexp/syntax: limit memory used by parsing regexps
A flaw was found in the golang package, where programs that compile regular expressions from untrusted sources are vulnerable to memory exhaustion or a denial of service. The parsed regexp representation is linear in the input size. Still, in some cases, the constant factor can be as high as...
OESA-2023-1421 texlive-base security update
The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font...