CVE-2024-25885

An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service ReDOS via supplying a crafted string...

CVE-2024-25885

An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service ReDOS via supplying a crafted string...

CVE-2024-47822 Directus inserts access token from query string into logs

Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in req.query is not redacted when the LOGSTYLE is set to raw. If these logs are no...

CVE-2024-47822 Directus inserts access token from query string into logs

Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in req.query is not redacted when the LOGSTYLE is set to raw. If these logs are no...

CVE-2024-45330

A use of externally-controlled format string in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.2 through 7.2.5 allows attacker to escalate its privileges via specially crafted requests...

CVE-2024-45330

CVE-2024-45330 describes an externally-controlled format string vulnerability in Fortinet FortiAnalyzer affecting 7.4.0–7.4.3 and 7.2.2–7.2.5. The flaw allows an attacker to escalate privileges by sending specially crafted requests. The available sources confirm the affected product and impact; n...

CVE-2024-45330

A use of externally-controlled format string in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.2 through 7.2.5 allows attacker to escalate its privileges via specially crafted requests...

SUSE-SU-2024:3543-1 Security update for json-lib

This update for json-lib fixes the following issues: - CVE-2024-47855: Fixed mishandled unbalanced comment string bsc1231295...

CVE-2024-25885

An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service ReDOS via supplying a crafted string...

CVE-2024-25885

An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service ReDOS via supplying a crafted string...

Format String Bug in fazsvcd

...

CVE-2024-45330: Use of Externally-Controlled Format String

A use of externally-controlled format string in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.2 through 7.2.5 allows attacker to escalate its privileges via specially crafted requests...

CVE-2024-25885

An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service ReDOS via supplying a crafted string...

PT-2024-7091 · Tp Link · Tp-Link Tl-Wdr7660

Name of the Vulnerable Software and Affected Versions: TP-Link TL-WDR7660 version 1.0 Description: The issue is related to the wlanTimerRuleJsonToBin function, which handles input data without proper size validation, potentially leading to a stack overflow. This can be exploited by a remote...

PT-2024-40433 · Surrealdb · Surrealdb

Name of the Vulnerable Software and Affected Versions: SurrealDB versions prior to 2.0.4 Description: The issue occurs when the parser fails to handle the conversion of an empty string to a SurrealDB value, such as when casting to a record, duration, or datetime, or when parsing an empty string t...

PT-2024-7093 · Tp Link · Tp-Link Tl-Wdr7660

Name of the Vulnerable Software and Affected Versions: TP-Link TL-WDR7660 version 1.0 Description: The issue is related to the wacWhitelistJsonToBin function, which handles the string name parameter without proper checking, potentially leading to stack overflow vulnerabilities. This can be...

xhtml2pdf security vulnerability

xhtml2pdf is xhtml2pdf open source an HTML to PDF converter using Python, ReportLab Toolkit, html5lib and pypdf. A security vulnerability exists in xhtml2pdf version 0.2.13, which stems from a problem in the getcolor function of utils.py, allowing an attacker to cause a regular expression denial ...

Fortinet FortiAnalyzer formatting string error vulnerability

Fortinet FortiAnalyzer is a centralized network security reporting solution from Fortinet, Inc. The product is mainly used to collect network log data and analyze, report, and archive operations on security events, network traffic, Web content, etc. in the logs through the reporting suite. A...

CVE-2024-31228

A flaw was found in Redis. This flaw allows authenticated users to trigger a denial of service by using specially crafted, long string match patterns on supported commands such as KEYS, SCAN, PSUBSCRIBE, FUNCTION LIST, COMMAND LIST, and ACL definitions. Matching of extremely long patterns may...

UBUNTU-CVE-2024-31228

Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as KEYS, SCAN, PSUBSCRIBE, FUNCTION LIST, COMMAND LIST and ACL definitions. Matching of extremel...