Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation. A security vulnerability exists in Mozilla Firefox that originates when opening Diagcab files without warning the user that the files may contain malicious code...

Exploit for Deserialization of Untrusted Data in Spip

Installation et Exécution du script 💻 Prérequis Avant de...

USN-6191-1 linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon regression

USN-6081-1, USN-6084-1, USN-6092-1 and USN-6095-1 fixed vulnerabilities in the Linux kernel. Unfortunately, that update introduced a spurious warning in the IPv6 subsystem. This update removes the undesired warning message...

PT-2023-36315 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue concerns a spurious warning introduced in the IPv6 subsystem of the Linux kernel after updates USN-6081-1, USN-6084-1, USN-6092-1, and USN-6095-1, which were intended to fix...

SpiceDB's LookupResources may return partial results

Impact Any user making a negative authorization decision based on the results of a LookupResources request with 1.22.0 is affected. For example, using LookupResources to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using...

Important: perl-HTTP-Tiny

Issue Overview: Warning has been added when HTTP::Tiny is used without verifyssl flag CVE-2023-31486 Affected Packages: perl-HTTP-Tiny Issue Correction: Run yum update perl-HTTP-Tiny or yum update --advisory ALAS-2023-1771 to update your system. New Packages: noarch: ...

CVE-2023-35930 LookupResources may return partial results in spicedb

SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a negative authorization decision based on the results of a LookupResources request with 1.22.0 is affected. For example, using LookupResources...

CVE-2023-26436

Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization. Access to this API endpoint is restricted to local networks by default. Arbitrary code could be injected that is being executed when processin...

Deserialization of untrusted data

Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization. Access to this API endpoint is restricted to local networks by default. Arbitrary code could be injected that is being executed when processin...

CVE-2023-26436

Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization. Access to this API endpoint is restricted to local networks by default. Arbitrary code could be injected that is being executed when processin...

KLA50365 ACE vulnerability in LibreOffice

Improper Input Validation vulnerability was found in LibreOffice. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories Arbitrary File Write in hsqldb 1.8.0 Related products LibreOffice CVE list CVE-2023-1183 high Solution Update to the latest version...

PT-2025-49732

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.14.0-319.el9.x86 64 1 Description The Linux kernel contained an issue where devlink port type warn would schedule a warning when a devlink port type was not set, but the warning did not clearly indicate which...

Warning: Victims' faces placed on explicit images in sextortion scam

The FBI has issued a warning about criminals digitally manipulating people's faces on to pornographic images--known as deepfaking--and then using those images to harass or extort money out of their victim in a practice known as sextortion. The FBI said the victims include children. From the...

Important: samba

Issue Overview: An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store. CVE-2018-14628 A user with sufficient...

MAL-2023-881 Malicious code in theme-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7162ab25878f8f496bd39b46209cf74bee0f29b34253a0f1cca5d6a48ba830bb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-33740

Incorrect access control in luowice v3.5.18 allows attackers to access cloud source code information via modification fo the Verify parameter in a warning message...

Improper access control

Incorrect access control in luowice v3.5.18 allows attackers to access cloud source code information via modification fo the Verify parameter in a warning message...

PT-2023-24465 · Luowice · Luowice

Name of the Vulnerable Software and Affected Versions: luowice version 3.5.18 Description: The issue allows attackers to access cloud source code information due to incorrect access control. This is achieved by modifying the Verify parameter in a warning message. Recommendations: For luowice...

CVE-2023-33740

Incorrect access control in luowice v3.5.18 allows attackers to access cloud source code information via modification fo the Verify parameter in a warning message...

Liferay Portal 7.4.3.21 <= 7.4.3.62 XSS

Cross-site scripting XSS vulnerability in the Account module in Liferay Portal allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user's 1 First Name, 2 Middle Name, 3 Last Name, or 4 Job Title text field. Note that Nessus has not tested for this...