3592 matches found
Mozilla Firefox Security Bypass Vulnerability (CNVD-2023-68480)
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A code execution vulnerability exists in Mozilla Firefox, which can be exploited by attackers to execute arbitrary code or cause a denial of service on a vulnerable system using unknown attack vectors...
GStreamer SRT File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of SRT...
XWiki Platform vulnerable to Code Injection in icon themes
Impact By either creating a new or editing an existing document with an icon set, an attacker can inject XWiki syntax and Velocity code that is executed with programming rights and thus allows remote code execution. There are different attack vectors, the simplest is the Velocity code in the icon...
GraphQL vs gRPC: Which One Creates More Secure APIs?
Learn about the security capabilities of GraphQL and gRPC, how they perform authentication/authorization, and how they compare to REST. In addition, discover common attack vectors for both API frameworks and how to prevent them...
Join our digital event to learn what’s new in Microsoft Entra
Editors note 6/15/2023: This blog has been updated to reflect the new date for this event, which is now July 11, 2023. It was previously scheduled for June 20, 2023. In today’s interconnected world, there’s virtually no limit to what technology can help us achieve. Millions of connections happen...
Reentrancy guard in rageQuit() can be bypassed
Lines of code Vulnerability details Reentrancy guard in rageQuit can be bypassed The reentrancy guard present in the rageQuit function can be bypassed by host accounts, leading to reentrancy attack vectors and loss of funds. Impact The new rageQuit function can be used by party members to exit...
The nature of cyberincidents in 2022
Kaspersky offers various services to organizations that have been targeted by cyberattackers, such as incident response, digital forensics, and malware analysis. In our annual incident response report, we share information about the attacks that we investigated during the reporting period. Data...
Improper header validation in httpsoft/http-message
Impact Improper header parsing. An attacker could sneak in a newline \n into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. Patches The issue is patched in 1.0.12. Workarounds The...
Lack of validation in opening positions parameters can lead to critical vulnerabilities at protocol level
Lines of code Vulnerability details Suspicious positions may be denied by voters if they don't seem legit, but over time it is very possible that one of them lands in the protocol, which can involve serious risks. Some attributes may not seem harmful with certain values at first sight, and can le...
K15480: PHP vulnerability CVE-2012-2688
Security Advisory Description Description Unspecified vulnerability in the phpstreamscandir function in the stream implementation in PHP before 5.3.15 and 5.4.x before 5.4.5 has unknown impact and remote attack vectors, related to an "overflow." CVE-2012-2688 Impact None. F5 products are not...
K14734: Apache HTTP server vulnerability CVE-2013-2249
Security Advisory Description modsessiondbd.c in the modsessiondbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for a session without considering the dirty flag and the requirement for a new session ID, which has unspecified impact and remote attack vectors...
SUSE CVE-2004-0505
The AIM dissector in Ethereal 0.10.3 allows remote attackers to cause a denial of service assert error via unknown attack vectors...
SUSE CVE-2004-2265
UUDeview 0.5.20 and earlier handles temporary files insecurely during decoding, with unknown attack vectors and impact...
SUSE CVE-2005-1458
Multiple unknown "other problems" in the KINK dissector in Ethereal before 0.10.11 have unknown impact and attack vectors...
SUSE CVE-2005-1769
Multiple cross-site scripting XSS vulnerabilities in SquirrelMail 1.4.0 through 1.4.4 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors in 1 the URL or 2 an e-mail message...
SUSE CVE-2005-2366
Unknown vulnerability in the BER dissector in Ethereal 0.10.11 allows remote attackers to cause a denial of service abort or infinite loop via unknown attack vectors...
SUSE CVE-2005-3068
Unspecified vulnerability in Eric Integrated Development Environment eric3 before 3.7.2 has unknown impact and attack vectors related to a "potential security exploit."...
SUSE CVE-2005-3340
The tuxpaint-import.sh script in Tux Paint tuxpaint 0.9.14 and earlier creates temporary files insecurely, with unknown impact and attack vectors...
SUSE CVE-2005-3904
Unspecified vulnerability in Java Management Extensions JMX in Java JDK and JRE 5.0 Update 3, 1.4.2 and later, 1.3.1 and later allows remote attackers to escape the Java sandbox and access arbitrary files or execute arbitrary application via unknown attack vectors...