y-navi.jp Cross Site Scripting vulnerability OBB-3734493

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Malicious code in spaceboo-y (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d9861de0db14f13361149470204707691f9711304b4ed49c191312836812a955 The OpenSSF Package Analysis project identified 'spaceboo-y' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

PT-2023-17664 · Imgsys · Imgsys

Name of the Vulnerable Software and Affected Versions: imgsys affected versions not specified Description: The issue is related to a possible out of bounds read and write due to missing valid range checking in imgsys. This could lead to local escalation of privilege, with System execution...

CVE-2021-33390

dpic 2021.04.10 has a use-after-free in thedeletestringbox function in dpic.y. A different vulnerablility than CVE-2021-32421...

CVE-2023-20805

In imgsys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07199773; Issue ID: ALPS07326411...

CLSA-2023-1685633907 vim: Fix of CVE-2023-2609

CVE-2023-2609: check "yarray" is not NULL...

y-treff.de Cross Site Scripting vulnerability OBB-3279898

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GLPI v10.0.1 - Unauthenticated Sensitive Data Exposure Vulnerability

Exploit Title: GLPI v10.0.1 - Unauthenticated Sensitive Data Exposure Version: =10.0.0 and 10.0.2 Author: Nuri Çilengir Vendor Homepage: https://glpi-project.org/ Software Link: https://github.com/glpi-project/glpi Advisory:...

Security fix for the ALT Linux 10 package clamav version 0.103.8-alt1

0.103.8-alt1 built March 15, 2023 Sergey Y. Afonin in task 316417 March 9, 2023 Sergey Y. Afonin - 0.103.8 CVE-2023-20032, CVE-2023-20052...

Malicious Package

Overview y-dot is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was install...

SUSE CVE-2012-2147

munin-cgi-graph in Munin 2.0 rc4 allows remote attackers to cause a denial of service disk or memory consumption via many image requests with large values in the 1 sizex or 2 sizey parameters...

SUSE CVE-2019-9770

An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a heap-based buffer overflow in the function dwgdecodeeeddata at decode.c for the y dimension...

SUSE CVE-2021-3941

In ImfChromaticities.cpp routine RGBtoXYZ, there are some division operations such as float Z = 1 - chroma.white.x - chroma.white.y Y / chroma.white.y; and chroma.green.y X + Z / d; but the divisor is not checked for a 0 value. A specially crafted file could trigger a divide-by-zero condition whi...

SUSE CVE-2022-3964

A vulnerability classified as problematic has been found in ffmpeg. This affects an unknown part of the file libavcodec/rpzaenc.c of the component QuickTime RPZA Video Encoder. The manipulation of the argument ysize leads to out-of-bounds read. It is possible to initiate the attack remotely. The...

SUSE CVE-2022-30524

There is an invalid memory access in the TextLine class in TextOutputDev.cc in Xpdf 4.0.4 because the text extractor mishandles characters at large y coordinates. It can be triggered by for example sending a crafted pdf file to the pdftotext binary, which allows a remote attacker to cause a Denia...

Malicious code in discord-y (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b9bc853e58480e4605c8da7d15886586603a58b2706285c1a5d5370bfda5602b Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

MAL-2023-1797 Malicious code in discord-y (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b9bc853e58480e4605c8da7d15886586603a58b2706285c1a5d5370bfda5602b Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

tyn-y-coed.co.uk Cross Site Scripting vulnerability OBB-3162595

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

LISTSERV 17 Insecure Direct Object Reference

Exploit Title: LISTSERV 17 - Insecure Direct Object Reference IDOR Exploit Author: Shaunt D Vendor Homepage: https://www.lsoft.com/ Version: 17 Tested on: Windows Server 2019 CVE : CVE-2022-40319 Steps to replicate 1. Create two accounts on your LISTSERV 17 installation, logging into each one in ...

y-link.net Cross Site Scripting vulnerability OBB-3037312

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...