PT-2023-7016 · Tongda Oa · Tongda Oa

Name of the Vulnerable Software and Affected Versions: Tongda OA 2017 up to 11.9 Description: A critical vulnerability has been found in Tongda OA, related to the file general/system/censor words/module/delete.php. The issue is due to the lack of protection against SQL injection when handling the...

postgresql-server -- Memory disclosure in aggregate function calls

PostgreSQL Project reports: Certain aggregate function calls receiving "unknown"-type arguments could disclose bytes of server memory from the end of the "unknown"-type value to the next zero byte. One typically gets an "unknown"-type value via a string literal having no type designation. We have...

mariadb: lack of proper validation of a user-supplied string before using it as a format specifier

MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL...

mariadb: use-after-poison in Binary_string::free_buffer

A flaw was found in the MariaDB Server. It contains a use-after-free via the component,Binarystring::freebuffer at /sql/sqlstring.h, affecting availability...

aper GetBitString DoS

The vulnerability of the aper.GetBitString function in the NGAP Message Handler component of the 5G mobile communication network management software free5GC is related to improper cleaning or release of resources. Exploiting this vulnerability can allow an attacker to cause service failures...

kernel: wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: Fix global-out-of-bounds bug in rtl8812aephysettxpowerlimit There is a global-out-of-bounds reported by KASAN: BUG: KASAN: global-out-of-bounds in rtl8812aeeqnbyte.part.0+0x3d/0x84 rtl8821ae Read of size 1 at addr...

golang: html/template: backticks not treated as string delimiters

A flaw was found in Golang Go. This flaw allows a remote attacker to execute arbitrary code on the system, caused by not properly considering backticks as Javascript string delimiters. By sending a specially crafted request, an attacker execute arbitrary code on the system...

golang: html/template: backticks not treated as string delimiters

A flaw was found in Golang Go. This flaw allows a remote attacker to execute arbitrary code on the system, caused by not properly considering backticks as Javascript string delimiters. By sending a specially crafted request, an attacker execute arbitrary code on the system...

golang: html/template: backticks not treated as string delimiters

A flaw was found in Golang Go. This flaw allows a remote attacker to execute arbitrary code on the system, caused by not properly considering backticks as Javascript string delimiters. By sending a specially crafted request, an attacker execute arbitrary code on the system...

Rocky Linux 8 : rust-toolset:rhel8 (RLSA-2021:1935)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1935 advisory. - In the standard library in Rust before 1.49.0, String::retain function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when...

The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code (CVE-2014-9471)

The parsedatetime function in GNU coreutils allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a crafted date string, as demonstrated by the "--date=TZ="123"345" @1" string to the touch or date command...

Moderate: c-ares security, bug fix, and enhancement update

The c-ares C library defines asynchronous DNS Domain Name System requests and provides name resolving API. The following packages have been upgraded to a later upstream version: c-ares 1.19.1. BZ2210370 Security Fixes: c-ares: buffer overflow in configsortlist due to missing string length check...

PT-2023-32290

Name of the Vulnerable Software and Affected Versions The Crimson 3.2 Description The issue arises when the Windows-based configuration tool is used to define new passwords for users, and these passwords contain the percent % character. This can lead to invalid values being included, potentially...

Rocky Linux 8 : libinput (RLSA-2022:5331)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:5331 advisory. - A format string vulnerability was found in libinput CVE-2022-1215 Note that Nessus has not tested for this issue but has instead relied only on the application...

RockyLinux 8 : mariadb:10.5 (RLSA-2022:5826)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:5826 advisory. mariadb: MariaDB through 10.5.9 allows attackers to trigger a convertconsttoint use-after-free when the BIGINT data type is used CVE-2021-46669 mariadb:...

CLSA-2023-1698949696 httpd: Fix of CVE-2023-31122

CVE-2023-31122: modmacro: Fix out-of-bounds read vulnerability by using own strncmp function...

CLSA-2023-1698948956 httpd: Fix of CVE-2023-31122

CVE-2023-31122: modmacro: fix out-of-bounds read vulnerability by using own strncmp function...

c-ares: buffer overflow in config_sortlist() due to missing string length check

A flaw was found in the c-ares package. The aressetsortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity...

Cross site scripting

Reflected Cross-Site Scripting XSS vulnerability in dmpop Mejiro Commit Versions Prior To 3096393 allows attackers to run arbitrary code via crafted string in metadata of uploaded images...

PT-2023-9720

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the use of non-null-terminated strings in the TIPC Transparent Inter-Process Communication protocol, which can cause buffer overrun when passed through netlink...