yyjson has a Double Free vulnerability

Summary The pool series allocator poolmalloc/poolfree/poolrealloc by yysjon has a Double Free vulnerability, which may lead to arbitrary address writing and Denial of Service DoS attacks. Arbitrary address writing, combined with other legitimate or illegitimate operations of programs using this...

yyjson has a Double Free vulnerability

The pool series allocator poolmalloc/poolfree/poolrealloc by yysjon has a Double Free vulnerability, which may lead to arbitrary address writing and Denial of Service DoS attacks. Arbitrary address writing, combined with other legitimate or illegitimate operations of programs using this library,...

CVE-2024-0748

A compromised content process could have updated the document URI. This could have allowed an attacker to set an arbitrary URI in the address bar or history. This vulnerability affects Firefox 122...

Memory corruption

Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments...

The vulnerability of the Blitz Identity Provider software lies in its ability to redirect URL addresses, allowing a hacker to redirect a user to any arbitrary URL address.

The vulnerability of the Blitz Identity Provider software relates to the possibility of redirecting URL addresses. Exploiting this vulnerability allows a malicious actor to redirect users to any desired URL address by sending a specially crafted link...

CVE-2023-36673

An issue was discovered in Avira Phantom VPN through 2.23.1 for macOS. The VPN client insecurely configures the operating system such that all IP traffic to the VPN server's IP address is sent in plaintext outside the VPN tunnel, even if this traffic is not generated by the VPN client, while...

Vault.mintYieldFee FUNCTION CAN BE CALLED BY ANYONE TO MINT Vault Shares TO ANY RECIPIENT ADDRESS

Lines of code Vulnerability details Impact The Vault.mintYieldFee external function is used to mint Vault shares to the yield fee recipient. The function is an external function and can be called by anyone since there is no access control. The function will revert only under following two...

CVE-2023-31597

An issue in Zammad v5.4.0 allows attackers to bypass e-mail verification using an arbitrary address and manipulate the data of the generated user. Attackers are also able to gain unauthorized access to existing tickets...

Zammad 安全漏洞

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in Zammad version v5.4.0, which stems from a vulnerability that allows an attacker to bypass email authentication and manipulate generated user's data using an arbitrary address, as wel...

The vulnerability of the Git repository management system Gitea, related to the use of open redirection, allows a hacker to redirect a user to any arbitrary URL address.

The vulnerability of the Git repository management system Gitea is related to the use of open redirection. Exploiting this vulnerability could allow a malicious actor to redirect a user to an arbitrary URL address...

CVE-2023-26373 Adobe Dimension has an arbitrary address write vulnerability when parsing USDZ files

Adobe Dimension version 3.4.8 and earlier is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2023-26373 Adobe Dimension has an arbitrary address write vulnerability when parsing USDZ files

Adobe Dimension version 3.4.8 and earlier is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

Permit authorized callers can burn any amount of BYTES 2.0 tokens from an arbitrary address

Lines of code Vulnerability details Impact Using the burn function of BYTES 2.0, an authorized caller can burn an arbitrary amount of tokens from any address. I'm aware that it was mentioned in README.md of the project that this type of finding is out of the scope. but I believe it is still...

WooCommerce Multiple Customer Addresses & Shipping < 21.7 - Arbitrary Address Creation/Deletion/Access/Update via IDOR

The plugin does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the request, or is from a high privilege users, allowing any authenticated users, such as subscriber to add/update/duplicate/delete as well as retrieve addresses of other users. Run t...

[Tomo-H1] All funds can drain if some conditions matched

Lines of code Vulnerability details function finalizeWithdrawal uint256 l2BlockNumber, uint256 l2MessageIndex, uint16 l2TxNumberInBlock, bytes calldata message, bytes32 calldata merkleProof external nonReentrant senderCanCallFunctionallowList...

PT-2022-19217 · Zoom · Zoom Client For Meetings +1

Name of the Vulnerable Software and Affected Versions: Zoom Client for Meetings versions prior to 5.12.2 Description: The issue allows a malicious Zoom meeting URL to direct the user to connect to an arbitrary network address, potentially leading to additional attacks, including session takeovers...

Design/Logic Flaw

readelf in ToaruOS 2.0.1 has some arbitrary address read vulnerabilities when parsing a crafted ELF file...

CVE-2022-38934

CVE-2022-38934 affects ToaruOS 2.0.1, where readelf may read arbitrary addresses while parsing crafted ELF files. The NVD/NVD-derived metrics assign a low impact (AV:L/AC:L/PR:N/UI:R/C:N/I:N/A:L; base score 3.3). Connected Red Hat and other sources reiterate the readelf vector in ToaruOS 2.0.1; P...

CVE-2022-38934

readelf in ToaruOS 2.0.1 has some arbitrary address read vulnerabilities when parsing a crafted ELF file...

ToaruOS 缓冲区错误漏洞

ToaruOS is an open source computer operating system written in the C language. A security vulnerability exists in ToaruOS version 2.0.1, which stems from some arbitrary address read vulnerabilities in its readelf when parsing carefully crafted ELF files...