AZL-13212 CVE-2022-25147 affecting package apr-util for versions less than 1.6.3-1

Integer Overflow or Wraparound vulnerability in aprbase64 functions of Apache Portable Runtime Utility APR-util allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime Utility APR-util 1.6.1 and prior versions...

PT-2023-34901 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.271 Description: A general protection fault issue was discovered in the nilfs btree insert function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

jefferson 路径遍历漏洞

Jefferson is a JFFS2 filesystem extraction tool by the individual developer Stefan Viehböck. A security vulnerability exists in versions of jefferson prior to 0.4.1. An attacker can exploit this vulnerability by crafting malicious JFFS2 files that can be used to write arbitrary files outside of t...

CVE-2022-4828 Bold Timeline Lite < 1.1.5 - Contributor+ Stored XSS via Shortcode

The Bold Timeline Lite WordPress plugin before 1.1.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...

DEBIAN-CVE-2023-0472

Use after free in WebRTC in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

Softing uaToolkit Embedded 安全漏洞

Softing UaToolkit Embedded is used to support the development of embedded Opc Ua applications via client/server and publisher/subscriber communication by Softing Germany. A security vulnerability exists in Softing uaToolkit Embedded prior to version 1.41, which stems from an incorrectly formatted...

Econolite EOS traffic control software 访问控制错误漏洞

Econolite EOS traffic control software is Econolite's traffic control software that controls all Econolite traffic hardware. An access control error vulnerability exists in Econolite EOS traffic control software prior to version 3.2.23, which stems from improper access control and a lack of a...

Spotipy 路径遍历漏洞

Spotipy is the spotipy-dev individual developer's lightweight Python library for the Spotify Web API. A path traversal vulnerability exists in Spotipy versions prior to 2.22.1. An attacker can exploit this vulnerability to perform operations on API endpoints...

PT-2023-12824

Name of the Vulnerable Software and Affected Versions simple-git versions prior to 3.16.0 Description The issue is related to Remote Code Execution RCE due to improper input sanitization in the clone, pull, push, and listRemote methods. This vulnerability exists because of an incomplete fix of a...

cmark-gfm 资源管理错误漏洞

cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version with canonical Markdown syntax. A resource management error vulnerability exists in versions prior to cmark-gfm 0.29.0.gfm.7. An attacker could exploit this vulnerability to cause unlimited...

wolfSSL WOLFSSL_CALLBACKS Heap Buffer Over-Read

wolfSSL before 5.5.2: Heap-buffer over-read with WOLFSSLCALLBACKS ==================================================================== INFO ======= The CVE project has assigned the id CVE-2022-42905 to this issue. Severity: 9.1 CRITICAL Affected version: before 5.5.2 End of embargo: Ended October...

DEBIAN-CVE-2023-0358

Use After Free in GitHub repository gpac/gpac prior to 2.3.0-DEV...

PT-2023-15966 · Unknown · Async Http Client

Name of the Vulnerable Software and Affected Versions: Async HTTP Client versions prior to 1.13.2 Description: The issue is related to insufficient validation of HTTP header field values before sending them to the network, allowing attackers to inject new HTTP header fields or entirely new reques...

CVE-2022-43976

An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p03.2.2.17p04.7p0. Direct access to the API is possible on TCP port 8888 via programs located in the cgi-bin folder without any authentication...

DEBIAN-CVE-2022-47318

ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-46648...

The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product.

...

Apache HTTP Server 注入漏洞

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. A CLRF injection vulnerability exists in Apache HTTP Server versions prior to 2.4.55. The vulnerability stems from a Web applicati...

Mechanize 安全漏洞

Mechanize is an open source ruby library from Sparkle Motion. It is used to automate interactions with websites. A security vulnerability exists in versions of Mechanize prior to 0.4.6 that stems from vulnerability to regular expression denial of service ReDoS attacks...

WordPress plugin Themify Portfolio Post 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

phpMyFAQ 安全漏洞

phpMyFAQ is a multilingual, fully database-driven FAQ system by the individual developer Thorsten Rinne. A security vulnerability exists in phpMyFAQ versions prior to 3.1.10, which stems from the presence of weak passwords...