337 matches found
MAL-2025-13785 Malicious code in @zalastax/nolb-react-str (npm)
The package @zalastax/nolb-react-str was found to contain malicious code...
Important: kernel
Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ACPI: sysfs: validate return type of STR method CVE-2024-49860 In the Linux kernel, the following vulnerability has been resolved: driver core: bus: Fix double free in driver API busregister CVE-2024-50055 Affecte...
PT-2025-5638 · Crates.Io · Fast-Float2
Name of the Vulnerable Software and Affected Versions: No specific software or version is mentioned. Description: The issue arises from the fast float2::common::AsciiStr::first method within the AsciiStr struct, which uses the unsafe keyword to read from memory without performing bounds checking...
Unsoundness in anstream
When given a valid UTF8 string "ö\x1b😀", the function in crates/anstream/src/adapter/strip.rs will be confused. The UTF8 bytes are \xc3\xb6 then \x1b then \xf0\x9f\x98\x80. When looping over "non-printable bytes" \x1b\xf0 will be considered as some non-printable sequence. This will produce a brok...
CVE-2024-52723
In TOTOLINK X6000R V9.4.0cu.1041B20240224 in the shttpd file, the UciSet Str function is used without strict parameter filtering. An attacker can achieve arbitrary command execution by constructing the payload...
CVE-2024-52723
In TOTOLINK X6000R V9.4.0cu.1041B20240224 in the shttpd file, the UciSet Str function is used without strict parameter filtering. An attacker can achieve arbitrary command execution by constructing the payload...
CVE-2024-52723: Improper Neutralization of Special Elements used in an OS Command
In TOTOLINK X6000R V9.4.0cu.1041B20240224 in the shttpd file, the UciSet Str function is used without strict parameter filtering. An attacker can achieve arbitrary command execution by constructing the payload...
CVE-2024-52723
In TOTOLINK X6000R, affected firmware 9.4.0cu.1041_B20240224, the vulnerability stems from using the Uci_Set Str function in the shttpd file without strict parameter filtering. This can allow an attacker to craft a payload that leads to arbitrary command execution (remote, network-based access; n...
CVE-2024-52723
In TOTOLINK X6000R V9.4.0cu.1041B20240224 in the shttpd file, the UciSet Str function is used without strict parameter filtering. An attacker can achieve arbitrary command execution by constructing the payload...
D-Link DI-8003 security vulnerability
The D-Link DI-8003 is a wireless router from China-based AUO D-Link. A buffer overflow vulnerability exists in the D-Link DI-8003 version 16.07.16A1, which stems from the parameter str in the file /dbsrv.asp failing to correctly validate the length and size of the input data, which can be exploit...
PT-2024-7788 · D Link · D-Link Di-8003
Name of the Vulnerable Software and Affected Versions: D-Link DI-8003 version 16.07.16A1 Description: A critical issue has been found, affecting the function dbsrv asp of the file /dbsrv.asp. The manipulation of the argument str leads to a stack-based buffer overflow. This issue can be exploited...
AZL-50833 CVE-2024-49860 affecting package kernel for versions less than 5.15.173.1-1
In the Linux kernel, the following vulnerability has been resolved: ACPI: sysfs: validate return type of STR method Only buffer objects are valid return values of STR. If something else is returned descriptionshow will access invalid memory...
DEBIAN-CVE-2024-49860
In the Linux kernel, the following vulnerability has been resolved: ACPI: sysfs: validate return type of STR method Only buffer objects are valid return values of STR. If something else is returned descriptionshow will access invalid memory...
CVE-2024-49941: NULL Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: gpiolib: Fix potential NULL pointer dereference in gpiodgetlabel In gpiodgetlabel, it is possible that srcudereferencecheck may return a NULL pointer, leading to a scenario where label-str is accessed without verifying if label...
MAL-2024-9869 Malicious code in str-or-num (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in str-or-num (npm)
--- -= Per source details. Do not edit below this line.=-...
WolfSSL MatchDomainName Function Heap Buffer Overflow DoS
The vulnerability of the MatchDomainName function in the SSL/TLS library WolfSSL is related to the escape of the operation beyond the buffer in memory due to incorrect checking of pointers during the processing of the str parameter. Exploiting this vulnerability could allow a remote attacker to...
CLSA-2024-1726314076 python2: Fix of CVE-2023-27043
Bugfix for CVE-2023-27043, use str instead of unicode, adjust tests according to python2 specification...
PT-2024-41529
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538161 Crash type: UNKNOWN WRITE Crash state: bfd elf get str section bfd elf string from elf section bfd elf sym name...