DEBIAN-CVE-2023-48090

GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leaks in extractattributes mediatools/m3u8.c:329...

UBUNTU-CVE-2023-48090

GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leaks in extractattributes mediatools/m3u8.c:329...

WordPress Plugin Seraphinite Accelerator Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2023-8887 · Gpac +2 · Gpac +2

Name of the Vulnerable Software and Affected Versions: GPAC version 2.3-DEV-rev617-g671976fcc-master Description: The issue is related to a memory leak in the extract attributes function, located in media tools/m3u8.c:329, which can lead to a denial of service. This is due to the lack of memory...

CVE-2023-43177

CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes...

CVE-2023-43177

CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes...

Design/Logic Flaw

CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes...

QR Code Tag <= 1.0 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its qrcodetag shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Social Feed <= 1.5.4.6 - Author+ Stored XSS

Description The plugin does not validate and escape some of its socialfeed shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks...

ShortCodes UI <= 1.9.8 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

POWR < 2.2.0 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its powr-powr-pack shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Cross site scripting

The Shareaholic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'shareaholic' shortcode in versions up to, and including, 9.7.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

The vulnerability of the parse method in the json5 package manager library in NPM allows a hacker to trigger a service failure.

The vulnerability of the parse method in the json5 package manager library from NPM is related to uncontrolled changes to prototype attributes of objects. Exploiting this vulnerability could allow a malicious actor to cause service failures...

golang: html/template: improper handling of empty HTML attributes

A flaw was found in golang. Templates containing actions in unquoted HTML attributes, for example, "attr=." executed with empty input, could result in output that has unexpected results when parsed due to HTML normalization rules. This issue may allow the injection of arbitrary attributes into ta...

kernel: ext4: use-after-free in ext4_xattr_set_entry()

A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw allows a privileged local user to cause a system crash or other undefined behaviors...

golang: html/template: improper handling of empty HTML attributes

A flaw was found in golang. Templates containing actions in unquoted HTML attributes, for example, "attr=." executed with empty input, could result in output that has unexpected results when parsed due to HTML normalization rules. This issue may allow the injection of arbitrary attributes into ta...

SUSE CVE-2023-47108

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels net.peer.sock.addr and net.peer.sock.port that have unbound cardinality. It leads to the...

The vulnerability of the _bfd_elf_parse_attributes function in the elf-attrs.c component of the GNU Binutils development environment allows a attacker to cause a service failure.

The vulnerability of the bfdelfparseattributes function in the elf-attrs.c component of the GNU Binutils development environment is related to the allocation of unlimited memory. Exploiting this vulnerability allows a remote attacker to cause a service failure through a specially created ELF file...

The vulnerability of the ScreenSaverSetAttributes function in the X Window System X.Org Server, and the Wayland protocol for X.Org XWayland, allows a perpetrator to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the ScreenSaverSetAttributes function in the X Window System X.Org Server, and the Wayland protocol for X.Org XWayland, is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to access confidential data, compromise its...

The vulnerability of the _bfd_elf_parse_attributes function in the elf-attrs.c component of the GNU Binutils development environment allows a attacker to cause a service failure.

The vulnerability of the bfdelfparseattributes function in the elf-attrs.c component of the GNU Binutils development environment is related to reading data beyond the allowable buffer limits. Exploiting this vulnerability allows an attacker to cause service failures through a specially created EL...