892 matches found
CVE-2023-37613
A cross-site scripting XSS vulnerability in Assembly Software Trialworks v11.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the asset src parameter...
CVE-2023-37613
A cross-site scripting XSS vulnerability in Assembly Software Trialworks v11.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the asset src parameter...
Cross site scripting
A cross-site scripting XSS vulnerability in Assembly Software Trialworks v11.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the asset src parameter...
CVE-2023-37613
A cross-site scripting XSS vulnerability in Assembly Software Trialworks v11.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the asset src parameter...
PT-2023-26043 · Assembly · Trialworks
Name of the Vulnerable Software and Affected Versions: Assembly Software Trialworks version 11.4 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the asset src parameter. This enables the execution of...
CVE-2023-37613
CVE-2023-37613 describes an XSS vulnerability in Assembly Software Trialworks v11.4, where an attacker can inject a crafted payload into the asset src parameter to execute arbitrary web scripts/HTML in the victim’s browser. The connected sources consistently identify the affected product/version ...
CVE-2021-34123
An issue was discovered on atasm, version 1.09. A stack-buffer-overflow vulnerability in function aprintf in asm.c allows attackers to execute arbitrary code on the system via a crafted file...
org.apache.kylin:kylin-spark-test (=4.0.0-alpha), org.apache.kylin:kylin-tool-assembly (>=2.1.0 <=4.0.0-alpha) +2 more potentially affected by CVE-2022-24697 via org.apache.kylin:kylin-server-base (>=2.1.0 <=4.0.0-alpha)
org.apache.kylin:kylin-server-base MAVEN version =2.1.0, =2.1.0, =1.1.0, =1.1.0, =2.4.0 Source cves: CVE-2022-24697 Source advisory: OSV:GHSA-PPXX-M926-G569...
CVE-2023-35932
jcvi is a Python library to facilitate genome assembly, annotation, and comparative genomics. A configuration injection happens when user input is considered by the application in an unsanitized format and can reach the configuration file. A malicious user may craft a special payload that may lea...
Command injection
jcvi is a Python library to facilitate genome assembly, annotation, and comparative genomics. A configuration injection happens when user input is considered by the application in an unsanitized format and can reach the configuration file. A malicious user may craft a special payload that may lea...
CVE-2023-35932 jcvi vulnerable to Configuration Injection due to unsanitized user input
jcvi is a Python library to facilitate genome assembly, annotation, and comparative genomics. A configuration injection happens when user input is considered by the application in an unsanitized format and can reach the configuration file. A malicious user may craft a special payload that may lea...
CVE-2023-35932 jcvi vulnerable to Configuration Injection due to unsanitized user input
jcvi is a Python library to facilitate genome assembly, annotation, and comparative genomics. A configuration injection happens when user input is considered by the application in an unsanitized format and can reach the configuration file. A malicious user may craft a special payload that may lea...
Acheron - Indirect Syscalls For AV/EDR Evasion In Go Assembly
Acheron is a library inspired by SysWhisper3/FreshyCalls/RecycledGate, with most of the functionality implemented in Go assembly. acheron package can be used to add indirect syscall capabilities to your Golang tradecraft, to bypass AV/EDRs that makes use of usermode hooks and instrumentation...
DEBIAN-CVE-2023-31725
yasm 1.3.0.55.g101bc was discovered to contain a heap-use-after-free via the function expandmmacparams at yasm/modules/preprocs/nasm/nasm-pp.c...
Mozilla: Content process crash due to invalid wasm code
The Mozilla Foundation Security Advisory describes this flaw as: A type checking bug would have led to invalid code being compiled...
Mozilla: Content process crash due to invalid wasm code
The Mozilla Foundation Security Advisory describes this flaw as: A type checking bug would have led to invalid code being compiled...
A Bootiful Podcast: Sebastien Deleuze and James Ward on a Bootiful Podcast
Hi, Spring fans! In this installment, recorded live from Kotlin Conf 2023 in Amsterdam, I talk to Kotlin luminaries Sébastien Deleuze and James Ward about Kotlin's future, web assembly, and more...
Resizing tokenIds is wrong in CollectionBatchBuyOperator.execute()
Lines of code Vulnerability details Impact The implementation of resizing an array is wrong in assembly, so the length of the array tokenIds will be wrong. Proof of Concept In CollectionBatchBuyOperator.execute, tokenIds should be resized to tokensBought, and the implementation is as follows:...
A Cryptographic Near Miss
Go 1.20.2 fixed a small vulnerability in the crypto/elliptic package. The impact was minor, to the point that I don't think any application was impacted, but the issue was interesting to look at as a near-miss, and to learn from. Fundamentally, a scalar multiplication function was returning the...
