PT-2023-3046 · Mp4V2 · Mp4V2

Name of the Vulnerable Software and Affected Versions: mp4v2 version 2.1.3 Description: The issue is related to a memory leak via the MP4StringProperty class in the mp4v2 library, which can be exploited by a remote attacker to cause a denial of service. The vulnerability is also associated with t...

Medium: qt5-qtbase

Issue Overview: When using the Qt SQL ODBC driver plugin, then it is possible to trigger a DOS with a specifically crafted string RESERVED NOTE: https://www.qt.io/blog/security-advisory-qt-sql-odbc-driver-plugin NOTE: https://github.com/qt/qtbase/commit/aaf1381eab6292aa0444a5eadcc24165b6e1c02d 6....

CVE-2023-21118

In unflattenString8 of Sensor.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12...

Security Bulletin: Open Source Dependency Vulnerability

Summary IBM Edge Application Manager 4.5 has resolved the vulnerability. Vulnerability Details CVEID:CVE-2021-29060 DESCRIPTION: Node.js Color-String module is vulnerable to a denial of service, caused by an error when the application is provided and checks a crafted invalid HWB string. By sendin...

Design/Logic Flaw

In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap file pagefile.sys, hibernation file hiberfil.sys, or RAM dump of the entire system. The...

Virtuoso Open-Source Edition SQL injection vulnerabilities

Virtuoso Open-Source Edition is a high-performance and scalable multi-model RDBMS, data integration middleware, linked data deployment, and HTTP application server platform from OpenLink Software open source. A security vulnerability exists in Virtuoso Open-Source Edition version v7.2.9, which...

CVE-2023-32784

In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap file pagefile.sys, hibernation file hiberfil.sys, or RAM dump of the entire system. The...

CVE-2023-32784

KeePass 2.x before 2.54 is vulnerable to master password exposure from memory dumps (KeePass process dumps, pagefile.sys, hibernation files, or RAM). The first character cannot be recovered, but subsequent characters may be revealed due to memory handling in KeePass. KeePass 2.54 introduces mitig...

D-Link DIR-2150 SetSysEmailSettings EmailTo Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the SOAP A...

D-Link DIR-2150 SetNTPServerSettings Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the SOAP A...

Zyxel NBG-418N Wi-Fi Router Uncontrolled Format String DoS

The vulnerability of the microprogrammed Wi-Fi router Zyxel NBG-418N v2 lies in the use of uncontrolled format strings when processing binary files. Exploiting this vulnerability allows a remote attacker to cause service interruptions by sending specially crafted packets...

Huawei EulerOS: Security Advisory for pkgconf (EulerOS-SA-2023-1876)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for pkgconf (EulerOS-SA-2023-1851)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES15 Security Update : go1.20 (SUSE-SU-2023:2105-2)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2105-2 advisory. Update to 1.20.4 bnc1206346: - CVE-2023-24539: Fixed an improper sanitization of CSS values boo1211029. - CVE-2023-24540: Fixed an improper...

c-ares: buffer overflow in config_sortlist() due to missing string length check

A flaw was found in the c-ares package. The aressetsortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity...

kernel: mm/page_owner: use strscpy() instead of strlcpy()

In the Linux kernel, the following vulnerability has been resolved: mm/pageowner: use strscpy instead of strlcpy current-comm is not a string no guarantee for a zero byte in it. strlcpys1, s2, l is calling strlens2, potentially causing out-of-bound access, as reported by syzbot: detected buffer...

kernel: ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf()

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf snprintf returns the would-be-filled size when the string overflows the given buffer size, hence using this value may result in the buffer overflow although it's...

Distribution Security Vulnerabilities

Distribution is Distribution's individual developer's toolset for packaging, shipping, storing, and delivering content. A security vulnerability exists in Distribution that stems from allowing a malicious user to submit unreasonable values, resulting in the allocation of large arrays of strings...

PT-2023-8614

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 2.2-milestone-1 through 14.4.7 XWiki Platform versions 14.4.8 through 14.10.3 XWiki Platform versions 14.10.4 through 15.0-rc-1 excluding 14.10.4 and 15.0-rc-1 Description The issue allows execution of javascript with t...

PT-2023-22532 · Cesanta · Cesanta Mjs

Name of the Vulnerable Software and Affected Versions: Cesanta MJS version 1.26 Description: A Buffer Overflow issue allows a local attacker to cause a denial of service via the mjs mk string function in mjs.c. This issue can be exploited to disrupt service. Recommendations: For Cesanta MJS versi...