PT-2023-19822 · Unknown · Data Modem

Name of the Vulnerable Software and Affected Versions: Data Modem affected versions not specified Description: The issue is related to Information Disclosure in the Data Modem when performing a VoLTE call with an undefined RTCP FB line value. Recommendations: At the moment, there is no informatio...

imagemagick:encoder_heic_fuzzer: Use-of-uninitialized-value in decoder_context::construct_reference_picture_lists

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=6401129057222656 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderheicfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value...

libzip:zip_read_fuzzer: Use-of-uninitialized-value in lzma_index_hash_decode

Detailed Report: https://oss-fuzz.com/testcase?key=5152121978486784 Project: libzip Fuzzing Engine: libFuzzer Fuzz Target: zipreadfuzzer Job Type: libfuzzermsanlibzip Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: lzmaindexhashdecode liblzma.so.5 lzmacode...

libxml2:valid: Use-of-uninitialized-value in xmlParseStartTag2

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=4844822290366464 Project: libxml2 Fuzzing Engine: libFuzzer Fuzz Target: valid Job Type: libfuzzermsanlibxml2 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State...

libxml2:valid: Use-of-uninitialized-value in xmlParseStartTag2

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=4583634323243008 Project: libxml2 Fuzzing Engine: libFuzzer Fuzz Target: valid Job Type: libfuzzermsanlibxml2 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State...

Updated quictls packages fix security vulnerabilities

The updated packages fix security vulnerabilities: AES-SIV implementation ignores empty associated data entries. CVE-2023-2975 Excessive time spent checking DH keys and parameters. CVE-2023-3446 Excessive time spent checking DH q parameter value. CVE-2023-3817...

libzip:zip_write_encrypt_pkware_file_fuzzer: Use-of-uninitialized-value in _zip_stdio_op_write

Detailed Report: https://oss-fuzz.com/testcase?key=4874869814460416 Project: libzip Fuzzing Engine: libFuzzer Fuzz Target: zipwriteencryptpkwarefilefuzzer Job Type: libfuzzermsanlibzip Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: zipstdioopwrite readfile...

libxslt:xslt: Use-of-uninitialized-value in xmlParseElementStart

Project: https://gitlab.gnome.org/GNOME/libxslt.git Detailed Report: https://oss-fuzz.com/testcase?key=4848295186661376 Project: libxslt Fuzzing Engine: libFuzzer Fuzz Target: xslt Job Type: libfuzzermsanlibxslt Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

CVE-2023-43705

Os Commerce is currently susceptible to a Cross-Site Scripting XSS vulnerability. This vulnerability allows attackers to inject JS through the "translationvalue1" parameter, potentially leading to unauthorized execution of scripts within a user's web browser...

PT-2023-28923

Name of the Vulnerable Software and Affected Versions Os Commerce affected versions not specified Description The issue is a Cross-Site Scripting XSS vulnerability that allows attackers to inject JavaScript through the translation value1 parameter. This could potentially lead to unauthorized...

SUSE SLED15: gsl / gsl-devel / gsl-doc / gsl-examples / gsl-gnu-hpc / etc (SUSE-SU-2023:3858-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3858-1 advisory. - CVE-2020-35357: Fixed a stack out of bounds read in gslstatsquantilefromsorteddata. bsc1214681 Tenable...

CVE-2023-5215

A flaw was found in libnbd. A server can reply with a block size larger than 2^63 the NBD spec states the size is a 64-bit unsigned value. This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbdgetsize function...

CVE-2023-5215

A vulnerability CVE-2023-5215 affects libnbd where a server may reply with a block size larger than 2^63, violating the 64-bit unsigned size expectation in nbd_get_size() and potentially causing an application crash or other unintended behavior in NBD clients that mishandle the return value. Conn...

libnbd Security Vulnerabilities

libnbd is a library for editing NBD Network Block Device clients. A security vulnerability exists in libnbd that stems from an inability to properly handle the return value of the nbdgetsize function, which could lead to application crashes or other unexpected behavior on the client...

Information disclosure

A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access information outside of their regular...

CVE-2023-0833 Red hat a-mq streams: component version with information disclosure flaw

A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access information outside of their regular...

M-04 Unmitigated

Lines of code Vulnerability details Impact The previously identified vulnerability of potential rounding issues during reward calculations has not been fully mitigated. The current strategy to keep remainders and use them in subsequent claimAndSyncRewards calls does not adequately address the iss...

CVE-2023-40044

In WSFTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WSFTP Server operating system. Recent assessments: sfewer-r7 at October 02, 2023 8:11am UT...

Inflation attack in VotiumStrategy

Lines of code Vulnerability details Summary The VotiumStrategy contract is susceptible to the Inflation Attack, in which the first depositor can be front-runned by an attacker to steal their deposit. Impact Both AfEth and VotiumStrategy acts as vaults: accounts deposit some tokens and get back...

CVE-2023-0833: Generation of Error Message Containing Sensitive Information

A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access information outside of their regular...