mruby:mruby_fuzzer: Use-of-uninitialized-value in mrb_bint_powm

Project: https://github.com/mruby/mruby.git Detailed Report: https://oss-fuzz.com/testcase?key=5408871562149888 Project: mruby Fuzzing Engine: libFuzzer Fuzz Target: mrubyfuzzer Job Type: libfuzzermsanmruby Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

PT-2024-40214 · Surrealdb · Surrealdb

Name of the Vulnerable Software and Affected Versions: SurrealDB versions prior to 2.0.4 Description: The issue arises from the order in which permissions are processed, leading to potential leaks of field values or record contents to users without the required permissions. This can occur in...

PT-2024-6837

Name of the Vulnerable Software and Affected Versions Windows Hyper-V affected versions not specified Description The issue is related to a denial-of-service vulnerability in the Windows Hyper-V system, caused by incorrect checking of a function's return value. This could allow a remote attacker ...

Qualys VMDR Rated as the Only Leader and Outperformer by Independent Analyst Firm for the Second Consecutive Year

Qualys VMDR received the highest possible scores for risk-based assessment, cloud-native and serverless function scanning, and flexibility of deployment, among 20 vendors evaluated in this report. As the threat landscape evolves, vulnerability management remains a cornerstone of security...

CVE-2024-47764

A flaw was found in the Cookie Node.js module, a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter oth...

GHSA-PXG6-PF52-XH8X cookie accepts cookie name, path, and domain with out of bounds characters

Impact The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, serialize"userName=alert'XSS3'; Max-Age=2592000; a", value would result in "userName=alert'XSS3'; Max-Age=2592000; a=test", setting userName cookie to and ignoring value. ...

CVE-2024-47764

cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to...

CVE-2024-47764

cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to...

CVE-2024-47764

CVE-2024-47764 affects a Node.js cookie parsing/serialization package. The vulnerability arises because the cookie name can be used to influence other cookie fields, potentially yielding an unexpected cookie value; a similar escape can affect path and domain to alter other fields. Public advisori...

CVE-2024-47764

cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to...

CVE-2024-47764 cookie accepts cookie name, path, and domain with out of bounds characters

cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to...

OSV-2024-1175 Use-of-uninitialized-value in mark_context

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=370775021 Crash type: Use-of-uninitialized-value Crash state: markcontext incrementalgc mrbincrementalgc...

PT-2024-12113 · Taskcafe · Taskcafe

Name of the Vulnerable Software and Affected Versions: TaskCafe version 0.3.2 Description: The issue is related to a lack of validation in the Cookie value, which allows an unauthenticated attacker who knows a registered UserID to change the password of that user. This can be exploited by attacke...

Broadcom MPI3 Device Driver Heap Buffer Overflow

The vulnerability of the mpi3mrsasportadd function in the driver/scsi/mpi3mr/mpi3mrtransport.c file of the Broadcom MPI3 device driver for the Linux operating system is related to the lack of checks for valid values. Exploiting this vulnerability could allow an attacker to compromise the...

PT-2024-40592

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of "Use-of-uninitialized-value". The crash state involves several functions: mark context, incremental gc, and mrb...

CVE-2024-47764: Improper Neutralization of Special Elements in Output Used by a Downstream Component

cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to...

CLSA-2024-1727980155 python: Fix of CVE-2024-7592

CVE-2024-7592: fix algorithm with quadratic complexity to avoid using excess CPU resources while parsing the cookie value...

CVE-2024-41592

DrayTek Vigor3910 devices through 4.3.2.6 have a stack-based overflow when processing query string parameters because GetCGI mishandles extraneous ampersand characters and long key-value pairs...

capstone:fuzz_disasmv5: Use-of-uninitialized-value in DecodeCrosspathX3

Detailed Report: https://oss-fuzz.com/testcase?key=5835948544294912 Project: capstone Fuzzing Engine: libFuzzer Fuzz Target: fuzzdisasmv5 Job Type: libfuzzermsancapstone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: DecodeCrosspathX3 decodeToMCInst4...

CVE-2024-47803

CVE-2024-47803 affects Jenkins core: Jenkins 2.478 and earlier, and LTS 2.462.2 and earlier, where multi-line secrets entered via the secretTextarea form field are not redacted in error messages. This can leak secrets through logs or error responses. The issue is mitigated by upgrading to Jenkins...