EUVD-2023-1039

Malicious code in bioql PyPI...

Malicious code in browser-html-to-rtf (npm)

The package browser-html-to-rtf was found to contain malicious code...

Exploit for Use After Free in Microsoft

🛑 CVE-2025-21298 – Critical Zero-Click RCE in Microsoft Window...

Microsoft Office Word 365 Apps for Enterprise Buffer Overflow

The vulnerability of Microsoft Office Word and 365 Apps for Enterprise lies in the overflowing of buffers in the dynamic memory. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created RTF file...

CVE-2005-2516

Safari in Mac OS X 10.3.9 and 10.4.2, when rendering Rich Text Format RTF files, can directly access URLs without performing the normal security checks, which allows remote attackers to execute arbitrary commands...

Khan Academy: Unauthorized Account Access via Leaked Credentials in URL Format (Account Takeover )

The vulnerability allowed attackers to access user accounts on khanAcademy.com using leaked credentials that were publicly available. The credentials were found in clear text format on a third-party website. By entering the email and password, the attacker could perform an account takeover withou...

PDF-XChange Editor Buffer Overflow

The vulnerability of PDF-XChange Editor’s PDF document viewing and editing software lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability can allow an attacker to execute arbitrary code using a specially created RTF file...

Tracker Software PDF-XChange Editor security vulnerabilities

Tracker Software PDF-XChange Editor is a suite of software for viewing and editing PDF format files from Tracker Software, a Canadian company. A security vulnerability exists in Tracker Software PDF-XChange Editor that stems from the RTF file parsing module containing a heap-based buffer overflow...

CVE-2024-54123: Improper Neutralization of Input During Web Page Generation

Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format...

CVE-2024-54123

Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format...

IBM Cognos Dashboards Open Information Disclosure

The vulnerability of IBM Cognos Dashboards on Cloud Pak for Data, related to the transmission of critical information in open text format. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

Security Bulletin: Vulnerabilities in Google Protocol Buffers affect IBM watsonx.data

Summary Google Protocol Buffers and protobuf-java core and lite have multiple vulnerabilities that can affect watsonx.data. These vulnerablities include denail of service attacks and remote code executions, Vulnerability Details CVEID:CVE-2015-5237 DESCRIPTION: Google Protocol Buffers could allow...

Parsing issue in protobuf textformat

...

CVE-2024-5486

A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network...

CVE-2023-49113

The Kiuwan Local Analyzer KLA Java scanning application contains several hard-coded secrets in plain text format. In some cases, this can potentially compromise the confidentiality of the scan results. Several credentials were found in the JAR files of the Kiuwan Local Analyzer. The JAR file...

CVE-2024-3622

A flaw was found when using mirror-registry to install Quay. It uses a default secret, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry to have the same secret key. This flaw allows a...

CVE-2023-33373

Connected IO CVE-2023-33373 affects v2.1.0 and earlier, where passwords and credentials are stored in clear-text, enabling credential exfiltration and device impersonation. Impact is credential leakage with total compromise potential; exploitation is described conceptually, with no explicit in-wi...

CVE-2023-24535

A flaw was found in the golang implementation of the protobuf protocol. This issue occurs when parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input, which will cause a panic...

SUSE CVE-2023-24535

Parsing invalid messages can panic. Parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read such that parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic. Remediation Upgrade...