14299 matches found
CVE-2023-31722
There exists a heap buffer overflow in nasm 2.16.02rc1 GitHub commit: b952891...
UBUNTU-CVE-2023-24805
cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. If you use the Backend Error Handler beh to create an accessible network printer, this security vulnerability can cause remote code execution. beh.c...
kernel: dm thin: Use last transaction's pmd->root when commit failed
A metadata handling flaw was found in the Linux kernel device-mapper thin provisioning driver. After a failed metadata commit, the in-memory root pointer could reference a mixed set of fresh and stale tree nodes. Subsequent lookups may loop or stall. A local user could use this flaw to cause the...
CVE-2023-31922
QuickJS commit 2788d71 was discovered to contain a stack-overflow via the component jsproxyisArray at quickjs.c...
Design/Logic Flaw
Jerryscript 3.0 commit 05dbbd1 was discovered to contain out-of-memory issue in malloc...
CVE-2023-32073 AVideo command injection vulnerability
WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at plugin/CloneSite/cloneClient.json.php which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-30854, which affects WWBN AVideo up to...
PT-2023-23584 · Wwbn · Wwbn Avideo
Name of the Vulnerable Software and Affected Versions: WWBN AVideo versions prior to 12.4 Description: A command injection issue exists in WWBN AVideo, allowing Remote Code Execution when the CloneSite Plugin is used. This issue is related to the plugin/CloneSite/cloneClient.json.php endpoint. It...
CVE-2023-31920
JerryScript CVE-2023-31920 concerns an assertion failure in the vm_loop path (jerry-core/vm/vm.c) affecting JerryScript 3.0 (commit 05dbbd1). The vulnerability is local, with low attack complexity, no privileges required, but requires user interaction and results in a high availability impact (Do...
CVE-2023-31914
Removed by vendor...
PT-2023-23517 · Unknown · Jerryscript
Name of the Vulnerable Software and Affected Versions: Jerryscript version 3.0 commit 1a2c047 Description: An Assertion Failure was discovered in Jerryscript via the jmem heap finalize function at jerry-core/jmem/jmem-heap.c. Recommendations: For Jerryscript version 3.0 commit 1a2c047, consider...
PT-2023-23521 · Unknown · Jerryscript
Name of the Vulnerable Software and Affected Versions: Jerryscript version 3.0 commit 05dbbd1 Description: An Assertion Failure was discovered in Jerryscript via the vm loop at jerry-core/vm/vm.c. Recommendations: For Jerryscript version 3.0 commit 05dbbd1, consider restricting access to the vm...
PT-2023-23515 · Unknown · Jerryscript
Name of the Vulnerable Software and Affected Versions: Jerryscript version 3.0 commit 1a2c047 Description: An Assertion Failure was discovered in Jerryscript via the component parser parse class at jerry-core/parser/js/js-parser-expr.c. Recommendations: For Jerryscript version 3.0 commit 1a2c047,...
CVE-2023-31919
Jerryscript 3.0 commit 05dbbd1 was discovered to contain an Assertion Failure via the jcontextraiseexception at jerry-core/jcontext/jcontext.c...
CVE-2023-31916
CVE-2023-31916 affects JerryScript 3.0 (commit 1a2c047). The vulnerability is an Assertion Failure in the jmem_heap_finalize function (jerry-core/jmem/jmem-heap.c). CVSS metrics in the provided records show a local attack vector with low attack complexity, no privileges required, user interaction...
distribution catalog API endpoint can lead to OOM via malicious user input
Impact Systems that run distribution built after a specific commit running on memory-restricted environments can suffer from denial of service by a crafted malicious /v2/catalog API endpoint request. Patches Upgrade to at least 2.8.2-beta.1 if you are running v2.8.x release. If you use the code...
CVE-2023-32076
in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In versions 1.4.0 and prior, among the...
Design/Logic Flaw
in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In versions 1.4.0 and prior, among the...
CVE-2023-32076 in-toto vulnerable to Configuration Read From Local Directory
in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In versions 1.4.0 and prior, among the...