wolfSSL WOLFSSL_CALLBACKS Heap Buffer Over-Read

wolfSSL before 5.5.2: Heap-buffer over-read with WOLFSSLCALLBACKS ==================================================================== INFO ======= The CVE project has assigned the id CVE-2022-42905 to this issue. Severity: 9.1 CRITICAL Affected version: before 5.5.2 End of embargo: Ended October...

DEBIAN-CVE-2023-0358

Use After Free in GitHub repository gpac/gpac prior to 2.3.0-DEV...

PT-2023-15966 · Unknown · Async Http Client

Name of the Vulnerable Software and Affected Versions: Async HTTP Client versions prior to 1.13.2 Description: The issue is related to insufficient validation of HTTP header field values before sending them to the network, allowing attackers to inject new HTTP header fields or entirely new reques...

CVE-2022-43976

An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p03.2.2.17p04.7p0. Direct access to the API is possible on TCP port 8888 via programs located in the cgi-bin folder without any authentication...

DEBIAN-CVE-2022-47318

ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-46648...

The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product.

...

Apache HTTP Server injection vulnerability

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. A CLRF injection vulnerability exists in Apache HTTP Server versions prior to 2.4.55. The vulnerability stems from a Web applicati...

Mechanize security vulnerabilities

Mechanize is an open source ruby library from Sparkle Motion. It is used to automate interactions with websites. A security vulnerability exists in versions of Mechanize prior to 0.4.6 that stems from vulnerability to regular expression denial of service ReDoS attacks...

WordPress plugin Themify Portfolio Post cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

phpMyFAQ security vulnerabilities

phpMyFAQ is a multilingual, fully database-driven FAQ system by the individual developer Thorsten Rinne. A security vulnerability exists in phpMyFAQ versions prior to 3.1.10, which stems from the presence of weak passwords...

Technitium DNS Server security vulnerability

Technitium DNS Server is an open source authoritative and recursive DNS server from the Technitium team. It can be used to self-host DNS servers for privacy and security. A security vulnerability exists in versions of Technitium DNS Server prior to 10.0, which stems from a loop occurring in its...

Flarum security vulnerabilities

Flarum is an open source forum system for the Flarum community. A security vulnerability exists in versions prior to Flarum v1.6.3. An attacker exploiting this vulnerability could read restricted/private content and bypass access checks for such content...

PT-2023-12769 · Com.Fasterxml · Java-Merge-Sort

Name of the Vulnerable Software and Affected Versions: com.fasterxml.util:java-merge-sort versions prior to 1.1.0 Description: The issue is related to an Insecure Temporary File in the StdTempFileProvider function, located in StdTempFileProvider.java. This function utilizes the permissive...

Zyxel NR7101 security vulnerabilities

The Zyxel NR7101 is a router from Hopkins Zyxel. A security vulnerability exists in versions prior to Zyxel NR7101 V1.15ACCC.3C0, which stems from a buffer overflow vulnerability in the CGI program parameters that allows an authenticated attacker to cause a denial of service DoS by sending a...

DEBIAN-CVE-2023-0131

Inappropriate implementation in in iframe Sandbox in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to bypass file download restrictions via a crafted HTML page. Chromium security severity: Medium...

PT-2023-14754

Name of the Vulnerable Software and Affected Versions Apache James MIME4J versions prior to 0.8.9 Description Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. Recommendations For Apache James MIME4J...

CVE-2022-47543

An issue was discovered in Siren Investigate before 12.1.7. There is an ACL bypass on global objects...

Wing-Tight security vulnerabilities

wing-tight is an application by aptic lava personal developer. A security vulnerability exists in wing-tight versions prior to 1.0.0, which stems from a problem in the unknown section of the file index.php, where manipulation of the parameter p results in a file inclusion...

Discourse code vulnerabilities

Discourse is an open source community discussion platform. The platform includes community, email and chat room features. A code issue vulnerability exists in versions prior to Discourse 2.8.14 that stems from when a user requests a password reset linked email and then changes their primary email...

Window-Control security vulnerabilities

window-control is a package from Bruno Robert's personal developer. It is designed to perform tasks similar to robot.js without mouse control, but without compiling external C++ code. A security vulnerability exists in window-control versions prior to 1.4.5, which stems from incorrect input and i...