wavpack:fuzzer: Use-of-uninitialized-value in decimate_dsd_run

Project: https://github.com/dbry/WavPack.git Detailed Report: https://oss-fuzz.com/testcase?key=5944336156262400 Project: wavpack Fuzzing Engine: libFuzzer Fuzz Target: fuzzer Job Type: libfuzzermsanwavpack Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

wavpack:fuzzer: Use-of-uninitialized-value in get_words_lossless

Project: https://github.com/dbry/WavPack.git Detailed Report: https://oss-fuzz.com/testcase?key=5316222086610944 Project: wavpack Fuzzing Engine: libFuzzer Fuzz Target: fuzzer Job Type: libfuzzermsanwavpack Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

libxml2:lint: Use-of-uninitialized-value in xmlEscapeText

Detailed Report: https://oss-fuzz.com/testcase?key=5374349233684480 Project: libxml2 Fuzzing Engine: libFuzzer Fuzz Target: lint Job Type: libfuzzermsanlibxml2 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: xmlEscapeText xmlHTMLError xmlCtxtErr Sanitizer:...

cryptsetup:crypt2_load_ondisk_fuzz: Use-of-uninitialized-value in crypt_volume_key_add_next

Project: https://gitlab.com/cryptsetup/cryptsetup.git Detailed Report: https://oss-fuzz.com/testcase?key=5017810845892608 Project: cryptsetup Fuzzing Engine: libFuzzer Fuzz Target: crypt2loadondiskfuzz Job Type: libfuzzermsancryptsetup Platform Id: linux Crash Type: Use-of-uninitialized-value Cra...

cryptsetup:crypt2_load_ondisk_fuzz: Use-of-uninitialized-value in crypt_free_volume_key

Project: https://gitlab.com/cryptsetup/cryptsetup.git Detailed Report: https://oss-fuzz.com/testcase?key=6540626414075904 Project: cryptsetup Fuzzing Engine: libFuzzer Fuzz Target: crypt2loadondiskfuzz Job Type: libfuzzermsancryptsetup Platform Id: linux Crash Type: Use-of-uninitialized-value Cra...

cryptsetup:crypt2_load_ondisk_fuzz: Use-of-uninitialized-value in crypt_free_volume_key

Project: https://gitlab.com/cryptsetup/cryptsetup.git Detailed Report: https://oss-fuzz.com/testcase?key=6514203221622784 Project: cryptsetup Fuzzing Engine: libFuzzer Fuzz Target: crypt2loadondiskfuzz Job Type: libfuzzermsancryptsetup Platform Id: linux Crash Type: Use-of-uninitialized-value Cra...

Joplin 输入验证错误漏洞

Joplin is an open source note-taking and to-do list application by Laurent Cozic Individual Developer. Joplin suffers from an input validation error vulnerability that originates in Joplin's HTML cleanup program that could result in a denial of service if the value of the specified name attribute...

Fake Google Chrome Sites Distribute ValleyRAT Malware via DLL Hijacking

Bogus websites advertising Google Chrome have been used to distribute malicious installers for a remote access trojan called ValleyRAT. The malware, first detected in 2023, is attributed to a threat actor tracked as Silver Fox, with prior attack campaigns primarily targeting Chinese-speaking...

mruby:mruby_fuzzer: Use-of-uninitialized-value in mark_context

Project: https://github.com/mruby/mruby.git Detailed Report: https://oss-fuzz.com/testcase?key=4710559466979328 Project: mruby Fuzzing Engine: libFuzzer Fuzz Target: mrubyfuzzer Job Type: libfuzzermsanmruby Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

CVE-2021-37643

TensorFlow is an end-to-end open source platform for machine learning. If a user does not provide a valid padding value to tf.rawops.MatrixDiagPartOp, then the code triggers a null pointer dereference if input is empty or produces invalid behavior, ignoring all values after the first. The...

CVE-2022-4541

The WordPress Visitors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a spoofed HTTP Header value in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2022-39389

Lightning Network Daemon lnd is an implementation of a lightning bitcoin overlay network node. All lnd nodes before version v0.15.4 are vulnerable to a block parsing bug that can cause a node to enter a degraded state once encountered. In this degraded state, nodes can continue to make payments a...

CVE-2025-24803

MobSF contains a Stored XSS in the iOS Dynamic Analyzer due to unsanitized CFBundleIdentifier input from Corellium in dynamic_analysis.html. An attacker can modify Info.plist to include special characters and trigger HTML context breaks when a malicious app is uploaded, enabling actions as users ...

llvm:llvm-isel-fuzzer--wasm32-O2: Use-of-uninitialized-value in WriteConstantInternal

Detailed Report: https://oss-fuzz.com/testcase?key=5875857583570944 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: llvm-isel-fuzzer--wasm32-O2 Job Type: libfuzzermsanllvm Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: WriteConstantInternal...

CVE-2024-29840

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOPEDITUSERGETPINFIELDS, allowing for an unauthenticated attacker to return the pin value of any user...

CVE-2024-50332

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Insufficient input value validation causes Blind SQL injection in DeleteRelationShip. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no know...

Syncfusion ej2-spreadsheet 安全漏洞

Syncfusion ej2-spreadsheet is a spreadsheet control from Syncfusion. A security vulnerability exists in Syncfusion ej2-spreadsheet version v27.2.2, which stems from the lib.setValue function containing a prototype contamination vulnerability...

Security Bulletin: Financial Transaction Manager for Digital Payments is impacted by multiple vulnerabilities in IBM Java SE

Summary Multiple vulnerabilities were addressed in Financial Transaction Manager 3.2.13 for Digital Payments, Corporate Payment Services and High Value Payments. Vulnerability Details CVEID:CVE-2024-21094 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow...

OSV-2024-1428 Use-of-uninitialized-value in next_uint16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=393742176 Crash type: Use-of-uninitialized-value Crash state: nextuint16 ntskeprocessreceive FuzzServer.c...

Important: kernel-livepatch-5.10.228-219.884

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix slab-use-after-free in gfs2qddealloc CVE-2023-52760 In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: Fix use after free in lineinfochangednotify CVE-2024-36899 In the...