CVE-2023-6780

An integer overflow was found in the vsysloginternal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation of the buffer size to store the message,...

CVE-2023-6780

An integer overflow was found in the vsysloginternal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation of the buffer size to store the message,...

CVE-2023-6780

An integer overflow was found in the vsysloginternal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation of the buffer size to store the message,...

MAL-2024-947 Malicious code in moblig-npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8a9601f46c6924bb210289c184590485d4dabf6696dc6c0da5720465002bcf06 The OpenSSF Package Analysis project identified 'moblig-npm' @ 1.0.4 npm as malicious. It is considered malicious because: - The package...

CVE-2023-5389

An attacker could potentially exploit this vulnerability, leading to the ability to modify files on Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC . This exploit could be used to write a file that may result in unexpected behavior based on configuration changes or updating of files...

CVE-2023-5389

An attacker could potentially exploit this vulnerability, leading to the ability to modify files on Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC . This exploit could be used to write a file that may result in unexpected behavior based on configuration changes or updating of files...

Out-of-bounds Write

ARM is vulnerable to Out-of-bounds Write. The vulnerability is due to arithmetic overflows during cache cleaning and invalidation, which can skip the intended cache operations, leading to undefined behavior where writes may not reach memory as expected...

Malicious code in dragon7-dc-vulntest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7fbbb2c388456ad9304f06570c8ddd459764422103836f0fac928c631d96cfec The OpenSSF Package Analysis project identified 'dragon7-dc-vulntest' @ 6.6.6 npm as malicious. It is considered malicious because: - The packag...

Security Bulletin: User Behavior Analytics application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM has addressed these vulnerabilities with an update. Vulnerability Details CVEID:CVE-2023-31484 DESCRIPTION: CPAN.pm is vulnerable to a man-in-the-middle...

Mozilla: Failure to update user input timestamp

The Mozilla Foundation Security Advisory describes this flaw as: It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timestamp used to prevent input after page load...

glibc 缓冲区错误漏洞

glibc GNU C Library is the C standard library implemented by the GNU Project. A security vulnerability exists in glibc 2.37 and earlier versions, which stems from the presence of an integer overflow that can be exploited by an attacker to cause the size of the buffer in which a message is stored ...

PT-2024-1610 · Glibc +1 · Glibc +1

Name of the Vulnerable Software and Affected Versions: glibc versions 2.37 and newer Description: The issue is related to an integer overflow in the vsyslog internal function of the glibc library, which is called by the syslog and vsyslog functions. This occurs when these functions are called wit...

MAL-2024-924 Malicious code in samsungads-publisher-portal-authorizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3bdf69166b497f7cd30a51ffff97b600796cbf77f8a34ead71e7ed700f40dfc7 The OpenSSF Package Analysis project identified 'samsungads-publisher-portal-authorizer' @ 99999.999.0 npm as malicious. It is considered...

SolarWinds Platform < 2023.3 Multiple Vulnerabilities

The version of SolarWinds Platform installed on the remote host is prior to 2023.3. It is, therefore, affected by multiple vulnerabilities as referenced in the solarwindsplatform20233 advisory. - The SolarWinds Network Configuration Manager was susceptible to the Directory Traversal Vulnerability...

Poisoning AI Models

New research into poisoning AI models: The researchers first trained the AI models using supervised learning and then used additional "safety training" methods, including more supervised learning, reinforcement learning, and adversarial training. After this, they checked if the AI still had hidde...

GHSA-W59H-378F-2FRM Unsound sending of non-Send types across threads in threadalone

Affected versions can run the Drop impl of a non-Send type on a different thread than it was created on. The flaw occurs when a stderr write performed by the threadalone crate fails, for example because stderr is redirected to a location on a filesystem that is full, or because stderr is a pipe...

GHSA-RJQ5-W47X-X359 @hono/node-server cannot handle "double dots" in URL

Impact Since v1.3.0, we use our own Request object. This is great, but the url behavior is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request will be in the resolved path. ts const req = new...

CVE-2024-23340 @hono/node-server can't handle "double dots" in URL

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with url behavior that is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request...

CVE-2024-23340 @hono/node-server can't handle "double dots" in URL

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with url behavior that is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request...

Malicious code in vscode-mlir (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c610eb26b75afffa49527255692e967a24bbe7fd61242d8c2f45420c72d9b589 The OpenSSF Package Analysis project identified 'vscode-mlir' @ 2.0.1 npm as malicious. It is considered malicious because: - The package execut...