GHSA-CRQF-Q9FP-HWJW Spring-Kafka has Java Deserialization vulnerability When Improperly Configured

In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers...

Deserialization of untrusted data

In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers...

CVE-2023-34040 Java Deserialization vulnerability in Spring-Kafka When Improperly Configured

In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers...

PT-2023-4537

Name of the Vulnerable Software and Affected Versions 7-Zip versions prior to 23.00 Description The issue is related to an integer underflow in the 7z file parser component of 7-Zip, allowing a remote attacker to execute arbitrary code on affected installations. This can be achieved by tricking t...

PT-2023-11668 · Freeimage +1 · Freeimage +1

Name of the Vulnerable Software and Affected Versions: FreeImage version 3.19.0 Description: The issue allows remote attackers to run arbitrary code via the opening of a crafted psd file. This is due to a Buffer Overflow vulnerability in the psdThumbnail::Read function in PSDParser.cpp...

PT-2023-25510 · Langchain · Langchain

Name of the Vulnerable Software and Affected Versions: langchain version 0.0.171 Description: An issue in langchain allows a remote attacker to execute arbitrary code via a JSON file to the load prompt parameter. This is related to subclasses or a template. Recommendations: For langchain version...

PT-2023-18871 · Typora · Typora

Name of the Vulnerable Software and Affected Versions: Typora versions prior to 1.6.7 Description: The issue allows a crafted markdown file to run arbitrary JavaScript code in the context of Typora's main window via loading typora://app/typemark/updater/update.html in an tag. This can be exploite...

CVE-2023-40168 Malicious projects can read and upload arbitrary files from disk in TurboWarp Desktop

TurboWarp is a desktop application that compiles scratch projects to JavaScript. TurboWarp Desktop versions prior to version 1.8.0 allowed a malicious project or custom extension to read arbitrary files from disk and upload them to a remote server. The only required user interaction is opening th...

PT-2023-5922 · Sap · Sap Powerdesigner Client

Name of the Vulnerable Software and Affected Versions: SAP PowerDesigner Client version 16.7 Description: The issue is related to the import function of BPMN files in the Business Process Modeling BPM module of the SAP PowerDesigner enterprise architecture modeling tool. It does not sufficiently...

PT-2025-1449 · Ashlar Vellum · Ashlar-Vellum Cobalt

Name of the Vulnerable Software and Affected Versions: Ashlar-Vellum Cobalt versions prior to v12 SP2 Build 1204.200 Description: The affected application lacks proper validation of user-supplied data when parsing CO files, which could lead to a heap-based buffer overflow. An attacker could...

PT-2023-4697 · Adobe · Dimension

Name of the Vulnerable Software and Affected Versions: Adobe Dimension version 3.4.9 Description: The issue is a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction, where a...

SUSE CVE-2023-3817

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHcheck, DHcheckex or EVPPKEYparamcheck to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been...

DOS for Handling of crafted recursive ASN.1 structures

Constructed ASN.1 types with a recursive definition such as can be found in PKCS7 could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources, s...

PT-2023-24959 · .Net · Greenshot

Name of the Vulnerable Software and Affected Versions: Greenshot versions 1.2.10 and below Description: The issue allows arbitrary code execution because .NET content is insecurely deserialized when a .greenshot file is opened. Recommendations: For Greenshot versions 1.2.10 and below, as a...

AZL-27815 CVE-2023-3817 affecting package openssl for versions less than 1.1.1k-26

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHcheck, DHcheckex or EVPPKEYparamcheck to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been...

DEBIAN-CVE-2023-3817

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHcheck, DHcheckex or EVPPKEYparamcheck to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been...

AZL-31139 CVE-2023-3817 affecting package edk2 for versions less than 20230301gitf80f052277c8-37

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHcheck, DHcheckex or EVPPKEYparamcheck to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been...

CVE-2023-3817 Excessive time spent checking DH q parameter value

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHcheck, DHcheckex or EVPPKEYparamcheck to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been...

CVE-2023-3446

A vulnerability was found in OpenSSL. This security flaw occurs because the applications that use the DHcheck, DHcheckex, or EVPPKEYparamcheck functions to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an...

UBUNTU-CVE-2023-3446

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHcheck, DHcheckex or EVPPKEYparamcheck to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been...