1038 matches found
CVE-2023-4997
Improper authorisation of regular users in ProIntegra Uptime DC software versions below 2.0.0.33940 allows them to change passwords of all other users including administrators leading to a privilege escalation...
AZL-30050 CVE-2023-42753 affecting package kernel for versions less than 5.15.135.1-2
An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the h-nets array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local...
AZL-28790 CVE-2023-3301 affecting package qemu for versions less than 6.2.0-23
A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an assertion and cause a denial of service...
AZL-28695 CVE-2023-39319 affecting package golang for versions less than 1.20.10-1
The html/template package does not apply the proper rules for handling occurrences of " contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack...
CVE-2023-40924
SolarView Compact 6.00 is vulnerable to Directory Traversal...
AZL-34770 CVE-2023-33953 affecting package grpc for versions less than 1.62.0-2
gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks: - Unbounded memory buffering in the HPACK parser - Unbounded CPU consumption ...
AZL-39394 CVE-2023-33953 affecting package python-tensorboard for versions less than 2.11.0-2
gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks: - Unbounded memory buffering in the HPACK parser - Unbounded CPU consumption ...
AZL-27870 CVE-2022-48579 affecting package clamav for versions less than 0.105.2-2
UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains...
AZL-33331 CVE-2023-3978 affecting package packer for versions less than 1.9.5-3
Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack...
AZL-27810 CVE-2023-3978 affecting package cert-manager for versions less than 1.11.2-14
Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack...
AZL-27638 CVE-2023-33952 affecting package hyperv-daemons for versions less than 5.15.158.1-1
A double-free vulnerability was found in handling vmwbufferobject objects in the vmwgfx driver in the Linux kernel. This issue occurs due to the lack of validating the existence of an object prior to performing further free operations on the object, which may allow a local privileged user to...
AZL-35139 CVE-2022-40896 affecting package python-pygments for versions less than 2.4.2-1
A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer...
AZL-37418 CVE-2023-29406 affecting package golang for versions less than 1.21.6-1
The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...
AZL-31659 CVE-2023-3354 affecting package qemu for versions less than 6.2.0-19
A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks whether the current number of connections crosses a certain threshold and if so, cleans up the previous connection. If the previous connection happens to be in the handshake phase and fails, QE...
CVE-2023-31238
A vulnerability has been identified in SICAM P850 7KG8500-0AA00-0AA0 All versions V3.11, SICAM P850 7KG8500-0AA00-2AA0 All versions V3.11, SICAM P850 7KG8500-0AA10-0AA0 All versions V3.11, SICAM P850 7KG8500-0AA10-2AA0 All versions V3.11, SICAM P850 7KG8500-0AA30-0AA0 All versions V3.11, SICAM P8...
AZL-37337 CVE-2023-29404 affecting package golang for versions less than 1.21.6-1
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "cgo LDFLAGS" directive. The arguments for a...
AZL-27065 CVE-2023-2603 affecting package libcap for versions less than 2.60-2
A vulnerability was found in libcap. This issue occurs in the libcapstrdup function and can lead to an integer overflow if the input string is close to 4GiB...
CVE-2023-33509
KramerAV VIA GO² 4.0.1.1326 is vulnerable to SQL Injection...
CVE-2023-0600 WP Visitor Statistics (Real Time Traffic) < 6.9 - Unauthenticated SQLi
The WP Visitor Statistics Real Time Traffic WordPress plugin before 6.9 does not escape user input which is concatenated to an SQL query, allowing unauthenticated visitors to conduct SQL Injection attacks...