PT-2023-7588 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 version US AC10V4.0si V16.03.10.13 cn Description: The issue is related to a stack overflow in the sub 47D878 function when handling the src parameter, potentially allowing a remote attacker to execute arbitrary code or cause a...

Malicious code in component---src-pages-corporate-delegate-packages-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94743768fa45d297822cb222b29ce23ca1ef1e8fbbc617de5e13df7b8fc60700 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in component---src-pages-corporate-delegate-packages-js

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2023-5268

A vulnerability was found in DedeBIZ 6.2 and classified as critical. This issue affects some unknown processing of the file /src/admin/makehtmltaglistaction.php. The manipulation of the argument mktime leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to...

CVE-2023-5266

A vulnerability, which was classified as critical, was found in DedeBIZ 6.2. This affects an unknown part of the file /src/admin/tagsmain.php. The manipulation of the argument ids leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public...

CVE-2023-5266

CVE-2023-5266 describes a critical SQL injection in DedeBIZ 6.2, affecting an unknown part of the file /src/admin/tags_main.php. The vulnerability arises from manipulation of the ids argument, enabling remote exploitation. Multiple sources confirm the issue and note that the exploit has been publ...

CVE-2023-5257 WhiteHSBG JNDIExploit HTTPServer.java handleFileRequest path traversal

A vulnerability was found in WhiteHSBG JNDIExploit 1.4 on Windows. It has been rated as problematic. Affected by this issue is the function handleFileRequest of the file src/main/java/com/feihong/ldap/HTTPServer.java. The manipulation leads to path traversal. The exploit has been disclosed to the...

CVE-2023-5266: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability, which was classified as critical, was found in DedeBIZ 6.2. This affects an unknown part of the file /src/admin/tagsmain.php. The manipulation of the argument ids leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public...

Important: libssh2

Issue Overview: An issue was discovered in function libssh2packetadd in libssh2 1.10.0 allows attackers to access out of bounds memory. CVE-2020-22218 Affected Packages: libssh2 Issue Correction: Run yum update libssh2 or yum update --advisory ALAS-2023-1834 to update your system. New Packages:...

Use After Free

libgpac.so is vulnerable for Use After Free. The vulnerability is due to a lack of memory location validation in ctx-reftkw within the ctx-tracks array in the mp4muxconfigurepid function of src/filters/muxisom.c...

CVE-2023-23623: Always-Incorrect Control Flow Implementation

Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. A Content-Security-Policy that disables eval, specifically setting a script-src directive and not providing unsafe-eval in that directive, is not respected in renderers that have sandb...

PT-2023-19083

Name of the Vulnerable Software and Affected Versions Electron versions 22 through 23 Description A Content-Security-Policy that disables eval is not respected in renderers with sandbox disabled, allowing methods like eval and new Function to be used unexpectedly, which can result in an expanded...

DEBIAN-CVE-2023-41633

Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/fileutil.c...

CVE-2023-41633

Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/fileutil.c...

CVE-2023-41633

Catdoc v0.95 contains a NULL pointer dereference in the xls2csv component (src/fileutil.c). This CVE (CVE-2023-41633) is supported by multiple sources (NVD, Red Hat, OSV, etc.). The vulnerability can cause crashes (availability impact), but exploitation details and a vendor patch are not provided...

CVE-2023-41633: NULL Pointer Dereference

Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/fileutil.c...

CVE-2023-41633

Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/fileutil.c...

Integer overflow

Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.6.0 and prior are vulnerable to integer overflow in consumecount of src/gnuv2/cplus-dem.c. The overflow check is valid logic but, is missing the modulus if the block once compiled. The compiler sees this block...

CVE-2023-40022: Integer Overflow or Wraparound

Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.6.0 and prior are vulnerable to integer overflow in consumecount of src/gnuv2/cplus-dem.c. The overflow check is valid logic but, is missing the modulus if the block once compiled. The compiler sees this block...

PT-2023-11547

Name of the Vulnerable Software and Affected Versions Dnsmasq versions up to and including 2.80 Description An issue was discovered in the /src/helper.c file of Dnsmasq, allowing attackers to cause a denial of service via the create helper function. Recommendations For Dnsmasq versions up to and...