PT-2024-40729 · Pcapng · Pcapng

Name of the Vulnerable Software and Affected Versions: pcapng affected versions not specified Description: The issue is related to a crash caused by the use of an uninitialized value. The crash occurs in the pcpp::PcapNgFileReaderDevice::getNextPacket function, which is called by...

CVE-2024-26331

ReCrystallize Server 5.10.0.0 uses a authorization mechanism that relies on the value of a cookie, but it does not bind the cookie value to a session ID. Attackers can easily modify the cookie value, within a browser or by implementing client-side code outside of a browser. Attackers can bypass t...

PT-2024-4042

Name of the Vulnerable Software and Affected Versions TPM2 Software Stack versions prior to 4.1.0 Description The issue is related to the TPM2 GENERATED VALUE function in the TCG TPM2 TPM2 Software Stack implementation. It lacks a check to ensure the magic number in the attest matches the TPM2...

shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems

A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This fl...

OSV-2024-328 Use-of-uninitialized-value in light_read_record

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=68173 Crash type: Use-of-uninitialized-value Crash state: lightreadrecord lightpcapngopenread pcpp::PcapNgFileReaderDevice::open...

OSV-2024-324 Use-of-uninitialized-value in do_callout_jit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=68365 Crash type: Use-of-uninitialized-value Crash state: docalloutjit jitmachinestackexec...

pcre2:pcre2_fuzzer_16_4l: Use-of-uninitialized-value in do_callout_jit

Project: svn://vcs.exim.org/pcre2/code/trunk https://github.com/PCRE2Project/pcre2.git Detailed Report: https://oss-fuzz.com/testcase?key=6165376946733056 Project: pcre2 Fuzzing Engine: libFuzzer Fuzz Target: pcre2fuzzer164l Job Type: libfuzzermsanpcre2 Platform Id: linux Crash Type:...

OSV-2024-309 Use-of-uninitialized-value in fast_forward_first_n_chars

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66944 Crash type: Use-of-uninitialized-value Crash state: fastforwardfirstnchars jitcompile pcre2jitcompile8...

PT-2024-40716 · Git +1 · Pcapplusplus

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash caused by a use-of-uninitialized-value error. The crash occurs in the following functions: light read record, light pcapn...

PT-2024-40709

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of Use-of-uninitialized-value. The crash state involves several functions: fast forward first n chars, jit compile,...

PT-2024-40714 · Git +1 · Pcre2

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue is related to a crash type of Use-of-uninitialized-value. The crash state includes do callout jit and jit machine stack exec functions. Recommendations: At the moment, there i...

CVE-2024-33891

Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. This is related to a hardcoded key, the use of the integer 2 for the Admin user, and removal of the oauthExpirationId attribute...

CVE-2024-32883 MCUboot Injection attack of unprotected TLV values

MCUboot is a secure bootloader for 32-bits microcontrollers. MCUboot uses a TLV tag-length-value structure to represent the meta data associated with an image. The TLVs themselves are divided into two sections, a protected and an unprotected section. The protected TLV entries are included as part...

OESA-2024-1498 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - ensure buffer for generate is completely filled The generate function in struct rngalg expects that the destination buffer is completely fille...

Envoy proxy server Heap Buffer Overflow DoS

The vulnerability of the Envoy proxy server is related to improper checking of the error value of the pointer. Exploiting this vulnerability can allow a malicious actor to cause an unexpected termination of the application...

PT-2024-6595

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the use of an uninitialized value size when calling amdgpu vce cs reloc in the drm/amdgpu module. This could potentially impact the confidentiality, integrity,...

CVE-2024-32883: Improper Validation of Integrity Check Value

MCUboot is a secure bootloader for 32-bits microcontrollers. MCUboot uses a TLV tag-length-value structure to represent the meta data associated with an image. The TLVs themselves are divided into two sections, a protected and an unprotected section. The protected TLV entries are included as part...

imagemagick:encoder_jxl_fuzzer: Use-of-uninitialized-value in jxl::RenderPipeline::InputReady

Detailed Report: https://oss-fuzz.com/testcase?key=6261165370966016 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderjxlfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: jxl::RenderPipeline::InputReady...

CVE-2022-36029 BigBlueButton Greenlight Open Redirect vulnerability

Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked the value of the returnto cookie. Versions 2.13.0 contains a patch for the issue...

HTML attributes vs DOM properties

Attributes and properties are fundamentally different things. You can have an attribute and property of the same name set to different values. For example: … const div = document.querySelector'divfoo=bar'; console.logdiv.getAttribute'foo'; // 'bar' console.logdiv.foo; // undefined div.foo = 'hell...