CVE-2023-46723 lte-pic32-writer's sendto.txt may disclose URL and the API key

lte-pic32-writer is a writer for PIC32 devices. In versions 0.0.1 and prior, those who use sendto.txt are vulnerable to attackers who known the IMEI reading the sendto.txt. The sendto.txt file can contain the SNSsuch as slack and zulip URL and API key. As of time of publication, a patch is not ye...

CVE-2023-46723

The CVE-2023-46723 issue affects lte-pic32-writer (versions 0.0.1 and earlier). The root cause is that the sendto.txt file can be read by anyone with knowledge of the IMEI, potentially exposing contained SNS URLs and API keys. Documented impact centers on confidentiality (exposure of keys/URLs); ...

PT-2023-30171 · Unknown · Lte-Pic32-Writer

Name of the Vulnerable Software and Affected Versions: lte-pic32-writer versions 0.0.1 and prior Description: The issue affects users of sendto.txt and allows attackers who know the IMEI to read the sendto.txt file, which may contain sensitive information such as SNS URLs and API keys...

lte-pic32-writer security vulnerability

lte-pic32-writer is a writing program for pic32 devices by paijp personal developer. A security vulnerability exists in lte-pic32-writer v0.0.1 and earlier versions, which originates from the fact that users with an IMEI can read sendto.txt, and the sendto.txt file can contain SNS e.g. slack, zul...

[SECURITY] Fedora 37 Update: python-configobj-5.0.8-6.fc37

ConfigObj is a simple but powerful configuration file reader and writer: an i ni file round tripper. Its main feature is that it is very easy to use, with a straightforward programmers interface and a simple syntax for config files...

PT-2023-29382 · Unknown · Recorp Ai Content Writing Assistant

Name of the Vulnerable Software and Affected Versions: ReCorp AI Content Writing Assistant Content Writer, GPT 3 & 4, ChatGPT, Image Generator All in One plugin versions = 1.1.5 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could...

DEBIAN-CVE-2022-4245

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtilwriteComment fails to sanitize comments for a -- sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection...

CVE-2022-4245

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtilwriteComment fails to sanitize comments for a -- sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection...

GHSA-RCX8-48PC-V9Q8 mail-internals use-after-free vulnerability in `vec_insert_bytes`

Incorrect reallocation logic in the function vecinsertbytes causes a use-after-free. This function does not have to be called directly to trigger the vulnerability because many methods on EncodingWriter call this function internally. The mail-\ suite is unmaintained and the upstream sources have...

Use-after-free in `vec_insert_bytes`

Incorrect reallocation logic in the function vecinsertbytes causes a use-after-free. This function does not have to be called directly to trigger the vulnerability because many methods on EncodingWriter call this function internally. The mail-\ suite is unmaintained and the upstream sources have...

WordPress GPT3 AI Content Writer Plugin < 1.7.40 is vulnerable to Cross Site Scripting (XSS)

Software GPT3 AI Content Writer Type Plugin Vulnerable versions 1.7.40 Fixed in 1.7.40 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 54c17caf61f9 Credits Rafie Muhammad Patchstack...

DEBIAN-CVE-2023-26590

A floating point exception vulnerability was found in sox, in the lsxaiffstartwrite function at sox/src/aiff.c:622:58. This flaw can lead to a denial of service...

PT-2023-23499 · Opentext · Opentext Documentum Content Server

Name of the Vulnerable Software and Affected Versions: OpenText Documentum Content Server versions prior to 23.2 Description: The issue allows for privilege escalation from a non-privileged Documentum user to root. The software comes prepackaged with a root-owned SUID binary dm secure writer. Thi...

PT-2025-49664

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists within the nilfs2 file system during the unmount process. Specifically, the nilfs root structure may be accessed after being freed, potentially leading to a...

kernel: ip: Fix data-races around sysctl_ip_prot_sock.

In the Linux kernel, the following vulnerability has been resolved: ip: Fix data-races around sysctlipprotsock. sysctlipprotsock is accessed concurrently, and there is always a chance of data-race. So, all readers and writers need some basic protection to avoid load/store-tearing...

codehaus-plexus: XML External Entity (XXE) Injection

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtilwriteComment fails to sanitize comments for a -- sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection...

USN-6012-1 smarty3 vulnerability

It was discovered that Smarty incorrectly parsed blocks' names and included files' names. A remote attacker with template writing permissions could use this issue to execute arbitrary PHP code. CVE-2022-29221...

syoyo tinydng 安全漏洞

syoyo tinydng is a loader and writer library by the individual developer Syoyo Fujita. A security vulnerability exists in syoyo tinydng, which stems from a problem with the function interceptormemcpy in the file tinydngloader.h, which can lead to a heap-based buffer overflow...

SUSE CVE-2008-6679

Buffer overflow in the BaseFont writer module in Ghostscript 8.62, and possibly other versions, allows remote attackers to cause a denial of service ps2pdf crash and possibly execute arbitrary code via a crafted Postscript file...

SUSE CVE-2009-2475

Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variables that are declared without the final keyword, related to 1 LayoutQueue, 2 Cursor.predefined, 3...