6446 matches found
AZL-28776 CVE-2023-32665 affecting package glib for versions less than 2.71.0-4
A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service...
AZL-28790 CVE-2023-3301 affecting package qemu for versions less than 6.2.0-23
A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an assertion and cause a denial of service...
AZL-35170 CVE-2023-3301 affecting package qemu for versions less than 8.2.0-1
A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an assertion and cause a denial of service...
CVE-2023-4875
Null pointer dereference when composing from a specially crafted draft message in Mutt 1.5.2 2.2.12...
AZL-37403 CVE-2023-39319 affecting package golang for versions less than 1.21.6-1
The html/template package does not apply the proper rules for handling occurrences of " contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack...
AZL-37386 CVE-2023-39318 affecting package golang for versions less than 1.21.6-1
The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "!" comment tokens, in contexts. This may cause the template parser to improperly interpret the contents of contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS atta...
AZL-28695 CVE-2023-39319 affecting package golang for versions less than 1.20.10-1
The html/template package does not apply the proper rules for handling occurrences of " contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack...
AZL-52735 CVE-2023-39318 affecting package golang for versions less than 1.20.10-1
The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "!" comment tokens, in contexts. This may cause the template parser to improperly interpret the contents of contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS atta...
CVE-2023-40924
SolarView Compact 6.00 is vulnerable to Directory Traversal...
AZL-31642 CVE-2023-4622 affecting package hyperv-daemons for versions less than 5.15.135.1-1
A use-after-free vulnerability in the Linux kernel's afunix component can be exploited to achieve local privilege escalation. The unixstreamsendpage function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there is a race where unixstreamsendpage could...
AZL-28676 CVE-2023-4244 affecting package kernel for versions less than 5.15.135.1-2
A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation. Due to a race condition between nftables netlink control plane transaction and nftset element garbage collection, it is possible to underflow the reference...
AZL-28659 CVE-2023-4781 affecting package vim for versions less than 9.0.1897-1
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873...
AZL-28629 CVE-2023-4736 affecting package vim for versions less than 9.0.1897-1
Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833...
AZL-28628 CVE-2023-4735 affecting package vim for versions less than 9.0.1897-1
Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847...
AZL-28627 CVE-2023-36328 affecting package tcl for versions less than 8.6.13-2
Integer Overflow vulnerability in mpgrow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service DoS...
SUSE CVE-2023-4573
When receiving rendering data over IPC mStream could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2...
SUSE CVE-2023-4580
Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information. This vulnerability affects Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2...
CVE-2023-40598
In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code ...
UBUNTU-CVE-2023-4579
Search queries in the default search engine could appear to have been the currently navigated URL if the search query itself was a well formed URL. This could have led to a site spoofing another if it had been maliciously set as the default search engine. This vulnerability affects Firefox 117...