25100 matches found
CVE-2024-38827
CVE-2024-38827 (IBM Controller) is described as a locale-dependent issue in String.toLowerCase()/toUpperCase() that could cause authorization rules to bypass. Affected product/version: IBM Controller 11.1.0–11.1.1. Remediation: upgrade to IBM Controller 11.1.2 (per IBM bulletin). Connected docs p...
Hewlett Packard Enterprise AutoPass License Server SQL Injection Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Hewlett Packard Enterprise AutoPass License Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 58...
CVE-2024-53861
pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for iss checking, resulting in "acb" being accepted for "abc". This is a bug introduced in version 2.10.0: checking the "iss" claim changed from isinstanceissuer, list to isinstanceissuer, Sequence. Since st...
CVE-2024-53861
pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for "iss" checking, resulting in ""acb"" being accepted for ""abc"". This is a bug introduced in version 2.10.0: checking the "iss" claim changed from "isinstanceissuer, list" to "isinstanceissuer, Sequence"...
CVE-2024-53861
pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for iss checking, resulting in "acb" being accepted for "abc". This is a bug introduced in version 2.10.0: checking the "iss" claim changed from isinstanceissuer, list to isinstanceissuer, Sequence. Since st...
PT-2024-35959
Name of the Vulnerable Software and Affected Versions: pyjwt versions 2.10.0 through 2.10.0 Description: An incorrect string comparison is run for iss checking, resulting in "acb" being accepted for " abc ". This is a bug introduced in version 2.10.0, where the "iss" claim checking changed from...
Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2024-8116)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-8116 advisory. - Fixes CVE-2024-21208 CVE-2024-21210 CVE-2024-21217 CVE-2024-21235 - 1001-orabug36904359-CVE-2024-21131-fix.patch -...
Oracle Linux 7 : java-11-openjdk (ELSA-2024-8120)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-8120 advisory. - Fixes CVE-2024-21208 CVE-2024-21210 CVE-2024-21217 CVE-2024-21235 - 1001-orabug36904359-CVE-2024-21138-fix.patch -...
CVE-2017-13323
In String16 of String16.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege in an unprivileged process with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2024-41125 Out-of-bounds read in SNMP when decoding a string in Contiki-NG
Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte can be triggered when sending a packet to a device running the Contiki-NG operating system with SNMP enabled. The SNMP module is disabled in the default Contiki-NG configuration. The...
CVE-2024-42330
The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This allows to create internal strings that...
Conversion of a wide string to a local string that leads to a heap of out-of-bound write
...
Conversion of a wide string to a local string that leads to a heap of out-of-bound write
...
Malicious code in string-process-mate (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2df355e26d748442b2bef75aff72f4bc8a791379093da56fffb1f7b7d9336ecd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-11010 Malicious code in string-process-mate (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2df355e26d748442b2bef75aff72f4bc8a791379093da56fffb1f7b7d9336ecd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malware in string-process-mate
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
CVE-2024-42330: Use of Externally-Controlled Format String
The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This allows to create internal strings that...
PT-2024-10592 · Google · Android +1
Name of the Vulnerable Software and Affected Versions: String16.cpp affected versions not specified Description: The issue is related to a possible out of bounds write due to an integer overflow in String16 of String16.cpp. This could lead to local escalation of privilege in an unprivileged proce...
CVE-2024-52337
A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick t...
