4336 matches found
PT-2024-20813
Name of the Vulnerable Software and Affected Versions Espruino version 2v20 commit fcc9ba4 Description A Stack Overflow issue was discovered in Espruino via the jspeFactorFunctionCall at src/jsparse.c. Recommendations For Espruino version 2v20 commit fcc9ba4, consider disabling the...
CVE-2024-25201: Out-of-bounds Read
Espruino 2v20 commit fcc9ba4 was discovered to contain an Out-of-bounds Read via jsvStringIteratorPrintfCallback at src/jsvar.c...
CVE-2024-24188: Out-of-bounds Write
Jsish v3.5.0 was discovered to contain a heap-buffer-overflow in ./src/jsiUtils.c...
CVE-2024-24188
Jsish v3.5.0 was discovered to contain a heap-buffer-overflow in ./src/jsiUtils.c...
CVE-2024-25201
Espruino 2v20 commit fcc9ba4 was discovered to contain an Out-of-bounds Read via jsvStringIteratorPrintfCallback at src/jsvar.c...
CVE-2024-25200
CVE-2024-25200 affects Espruino 2v20 (commit fcc9ba4). The vulnerability is a Stack Overflow via the jspeFactorFunctionCall in src/jsparse.c. Documented impact is high (availability), with network attack vector and no privileges required. No remediation details are provided in the supplied source...
CVE-2024-24263
Lotos WebServer v0.1.1 was discovered to contain a Use-After-Free UAF vulnerability via the responseappendstatusline function at /lotos/src/response.c...
CVE-2024-24263: Use After Free
Lotos WebServer v0.1.1 was discovered to contain a Use-After-Free UAF vulnerability via the responseappendstatusline function at /lotos/src/response.c...
CVE-2024-24266: Use After Free
gpac v2.2.1 was discovered to contain a Use-After-Free UAF vulnerability via the dasherconfigurepid function at /src/filters/dasher.c...
Low: sudo
Issue Overview: No CVE associated with this advisory Affected Packages: sudo Issue Correction: Run yum update sudo or yum update --advisory ALAS-2024-1917 to update your system. New Packages: i686: sudo-debuginfo-1.8.23-10.58.amzn1.i686 sudo-devel-1.8.23-10.58.amzn1.i686 ...
Important: nss
Issue Overview: A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is...
CVE-2024-0962: Stack-based Buffer Overflow
A vulnerability was found in obgm libcoap 4.3.4. It has been rated as critical. Affected by this issue is the function getsplitentry of the file src/coaposcore.c of the component Configuration File Handler. The manipulation leads to stack-based buffer overflow. The attack may be launched remotely...
GO-2024-2466 Denial of service in github.com/go-git/go-git/v5 and gopkg.in/src-d/go-git.v4
Denial of service in github.com/go-git/go-git/v5 and gopkg.in/src-d/go-git.v4...
whoogle-search Cross-Site Scripting Vulnerability
whoogle-search is a software application. Self-hosted, ad-free, privacy-respecting meta-search engine A cross-site scripting vulnerability exists in whoogle-search versions prior to 0.8.4, which stems from the element method in app/routes.py that does not validate user-controlled srctype and...
Important: apache-ivy
Issue Overview: When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain "../" sequences - which ar...
CVE-2024-22911
A stack-buffer-underflow vulnerability was found in SWFTools v0.9.2, in the function parseExpression at src/swfc.c:2602...
Stack overflow
swftools 0.9.2 was discovered to contain a stack-buffer-underflow vulnerability via the function parseExpression at swftools/src/swfc.c:2576...
CVE-2024-22911
A stack-buffer-underflow vulnerability was found in SWFTools v0.9.2, in the function parseExpression at src/swfc.c:2602...
Cross site scripting
The Qyrr WordPress plugin before 0.7 does not escape the data-uri of the QR Code when outputting it in a src attribute, allowing for Cross-Site Scripting attacks. Furthermore, the datauritometa AJAX action, available to all authenticated users, only had a CSRF check in place, with the nonce...
