edb 安全漏洞

edb is a cross-platform AArch32/x86/x86-64 debugger. A security vulnerability exists in Eteran edb-debugger version v.1.3.0, which can be exploited by an attacker to cause a denial of service via the collectsymbols function in plugins/BinaryInfo/symbols.cpp...

PT-2023-21311 · Eteran · Eteran Edb-Debugger

Name of the Vulnerable Software and Affected Versions: Eteran edb-debugger version 1.3.0 Description: The issue allows a local attacker to cause a denial of service via the collect symbols function in plugins/BinaryInfo/symbols.cpp. This can lead to a disruption in service. Recommendations: For...

Espruino 安全漏洞

Espruino is a JavaScript interpreter. It is designed for devices with only 128kB of flash memory and 8kB of RAM. A security vulnerability exists in Espruino version 2v05.41, which can be exploited by an attacker to cause a denial of service via the function jsvGarbageCollectMarkUsed in the file...

CVE-2023-1246

Files or Directories Accessible to External Parties vulnerability in Saysis Starcities allows Collect Data from Common Resource Locations. This issue affects Starcities: through 1.3...

CVE-2021-45478 IDOR in Yordam Library Automation System

Improper Handling of Parameters vulnerability in Bordam Information Technologies Library Automation System allows Collect Data as Provided by Users. This issue affects Library Automation System: before 19.2...

Splunk Enterprise 8.1 < 8.1.13, 8.2.0 < 8.2.10, 9.0.0 < 9.0.4 (SVD-2023-0210)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0210 advisory. - In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the collect' search processing language SPL command...

SUSE CVE-2015-4177

The collectmounts function in fs/namespace.c in the Linux kernel before 4.0.5 does not properly consider that it may execute after a path has been unmounted, which allows local users to cause a denial of service system crash by leveraging user-namespace root access for an MNTDETACH umount2 system...

SUSE CVE-2019-19047

A memory leak in the mlx5fwfatalreporterdump function in drivers/net/ethernet/mellanox/mlx5/core/health.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service memory consumption by triggering mlx5crdumpcollect failures, aka CID-c7ed6d0183d5...

CVE-2023-22940

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the ‘collect’ search processing language SPL command, including ‘summaryindex’, ‘sumindex’, ‘stash’,’ mcollect’, and ‘meventcollect’, were not designated as safeguarded commands. The commands could potentially allow for the...

CVE-2023-22940

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the ‘collect’ search processing language SPL command, including ‘summaryindex’, ‘sumindex’, ‘stash’,’ mcollect’, and ‘meventcollect’, were not designated as safeguarded commands. The commands could potentially allow for the...

PT-2023-18784 · Splunk · Splunk Enterprise

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 8.1.13 Splunk Enterprise versions prior to 8.2.10 Splunk Enterprise versions prior to 9.0.4 Description: The issue concerns aliases of the collect search processing language SPL command, including...

Icegram Collect < 1.3.9 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress Icegram Collect – Easy Form, Lead Collection and Subscription plugin Plugin <= 1.3.8 is vulnerable to Cross Site Scripting (XSS)

Software Icegram Collect – Easy Form, Lead Collection and Subscription plugin Type Plugin Vulnerable versions = 1.3.8 Fixed in 1.3.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25024 Patch priority Low CVSS severity Low 5.9 Developer Claim...

MAL-2023-814 Malicious code in stats-collect-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad3d02771bbae32c6827b2d78a02c6a6f23d67fca38cc7361fdcd739f0ee4398 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in stats-collect-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad3d02771bbae32c6827b2d78a02c6a6f23d67fca38cc7361fdcd739f0ee4398 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

reentrancy in TimeswapV2Option.collect()

Lines of code Vulnerability details Impact collect function doesn't respect the check-effect-interaction pattern, where in the case if a param.data is provided it makes an external call to the caller, right after that, it updates option short amount state. in the case if the caller calls back int...

[M] TimeswapV2LiquidityToken.sol#collect() Incorrect implementation causing collect always fail

Lines of code Vulnerability details Impact The function collect in the provided code is supposed to transfer transaction fees from a liquidity token position to a recipient address. However, the function currently has an issue where the long0Fees, long1Fees, and shortFees variables are not...

CVE-2022-41778

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-DataCollect service port without proper verification. An attacker could provide malicious serialized objects to execute arbitrary code upon deserialization...

WordPress alfred24 Click & Collect Plugin <= 1.1.7 is vulnerable to Cross Site Scripting (XSS)

Software alfred24 Click & Collect Type Plugin Vulnerable versions = 1.1.7 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-47158 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID bd2c86c67b0a Credits Team WeBoB...

alfred24 Click & Collect <= 1.1.7 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...