[SECURITY] Fedora 39 Update: editorconfig-0.12.7-1.fc39

EditorConfig makes it easy to maintain the correct coding style when switching between different text editors and between different projects. The EditorConfig project maintains a file format and plugins for various text editors which allow this file format to be read and used by those editors...

SQL Injection Vulnerability in SpringBlade of Shanghai Breadtech Co.

SpringBlade is a microservice architecture upgraded and optimized from a commercial-grade project, built with core technologies such as Spring Boot 2.5 and Spring Cloud 2020, and fully following Alibaba coding standards. Ltd. SpringBlade exists SQL injection vulnerability, attackers can use the...

AI Copilot: Launching Innovation Rockets, But Beware of the Darkness Ahead

Imagine a world where the software that powers your favorite apps, secures your online transactions, and keeps your digital life could be outsmarted and taken over by a cleverly disguised piece of code. This isn't a plot from the latest cyber-thriller; it's actually been a reality for years now...

Apache Zeppelin Cross-Site Scripting Vulnerability (CNVD-2024-17939)

Apache Zeppelin is a Web-based open source laptop application from the Apache USA Foundation. The program supports interactive data analysis and collaborative documentation. Apache Zeppelin suffers from a cross-site scripting vulnerability that stems from improper coding or escaping, which can be...

XWiki Platform 安全漏洞

XWiki Platform is the XWiki Foundation's suite of Wiki platforms for creating Web collaboration applications. A security vulnerability exists in XWiki Platform that originates when the Live Editor is installed in XWiki, which allows execution of arbitrary remote code through the interaction of an...

GHSA-MJ35-2RGF-CV8P OpenID Connect client Atom Exhaustion in provider configuration worker ets table location

Impact DOS by Atom exhaustion is possible by calling oidccproviderconfigurationworker:getproviderconfiguration/1 or oidccproviderconfigurationworker:getjwks/1. Since the name is usually provided as a static value in the application using oidcc, this is unlikely to be exploited. Details Example to...

The vulnerability of the `pic_parameter_set::dump()` function in the h.265 Libde265 implementation allows a attacker to disclose protected information or cause service failures.

The vulnerability of the picparameterset::dump function in the h.265 Libde265 implementation is related to buffer overflows caused by the parameters numtilecolumns and numtilerow. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information or cause service failures...

Virtuozzo Hybrid Infrastructure 6.1 (6.1.0-238)

In this release, Virtuozzo Hybrid Infrastructure introduces a new service---Backup and Restore as a Service---as well as provides a range of new features that cover improvements in the compute services and object storage. Additionally, this release delivers stability and security improvements, an...

Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment

Summary An attacker can exploit a critical flaw in the application to initiate a Denial of Service DoS attack, rendering the application inoperable and affecting all users. The issue arises from unsafe manipulation of an array in a multi-threaded environment. Details The vulnerability is rooted i...

Siemens Polarion ALM Faulty Default Privileges Vulnerability

Polarion ALM is an application lifecycle management solution that improves the software development process with a single, unified solution for requirements, coding, testing and release. Siemens Polarion ALM has a false default privilege vulnerability that can be exploited by an attacker to...

The vulnerability of the read_coding_unit function (slice.cc) in the h.265 Libde265 video codec implementation, which allows a perpetrator to influence the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the readcodingunit function slice.cc in the h.265 Libde265 video codec implementation is related to the output of operations that occur outside of the buffer in memory. Exploiting this vulnerability can allow a malicious actor to influence the confidentiality, integrity, and...

The vulnerability of the put_weighted_pred_avg_16_fallback() function (fallback-motion.cc) in the implementation of the h.265 Libde265 video codec allows a perpetrator to trigger a service failure.

The vulnerability of the putweightedpredavg16fallback function in the fallback-motion.cc implementation of the h.265 Libde265 codec is related to the occurrence of operations outside the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to trigger a service...

CVE-2023-34042

The CVE-2023-34042 issue concerns the Spring Security spring-security-config jar where the spring-security.xsd file is world-writable. This enables a local authenticated attacker to write the file, reflecting CWE-732: Incorrect Permission Assignment for Critical Resource. The connected IBM and OS...

TOTOLINK A8000RU 安全漏洞

TOTOLINK A8000RU is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A8000RU suffers from a Root hard-coding vulnerability, which can be exploited by remote attackers to submit a special request for unauthorized access to the system...

nextEpoch is incorrect

Lines of code Vulnerability details Impact Rewards and voting weights are aligned on a weekly basis. However, nextEpoch is calculated incorrectly, which may break the invariant "The total rewards that are sent for one block should never be higher than the rewards that were configured for this...

Wordfence Researcher Featured on Critical Thinking Podcast: Sharing Advanced WordPress Bug Bounty Tips and Tricks

Did you know were running a Bug Bounty Extravaganza again? Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through February 29th, 2024 when you opt to have Wordfence handle responsible disclosure! Today was another huge step forward in our continuing mission ...

CVE-2024-22415

jupyter-lsp is a coding assistance tool for JupyterLab code navigation + hover suggestions + linters + autocompletion + rename using Language Server Protocol. Installations of jupyter-lsp running in environments without configured file system access control on the operating system level, and with...

Design/Logic Flaw

jupyter-lsp is a coding assistance tool for JupyterLab code navigation + hover suggestions + linters + autocompletion + rename using Language Server Protocol. Installations of jupyter-lsp running in environments without configured file system access control on the operating system level, and with...

CVE-2024-22415

CVE-2024-22415 relates to the jupyter-lsp server extension for JupyterLab. The vulnerability stems from unsecured endpoints that, when the jupyter-server is exposed to untrusted networks, permit unauthorised access and modification of files outside the jupyter root. Fix: upgrade to version 2.2.2 ...

Unit Testing Frameworks: A Quick Comparison

Stepping Forward in Understanding Software Unit Evaluation Venturing into the realm of software creation, emphasizing quality takes center stage. This gold standard governs aspects such as operational capabilities, dependability, and the overall performance of your software. Regular assessments, ...