14169 matches found
CVE-2023-3609
A use-after-free vulnerability in the Linux kernel's net/sched: clsu32 component can be exploited to achieve local privilege escalation. If tcfchangeindev fails, u32setparms will immediately return an error after incrementing or decrementing the reference counter in tcfbindfilter. If an attacker...
CVE-2022-46290
Multiple out-of-bounds write vulnerabilities exist in the ORCA format nAtoms functionality of Open Babel 3.1.1 and master commit 530dbfa3. A specially-crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.The loop that...
PT-2023-6628
Name of the Vulnerable Software and Affected Versions Open Babel versions 3.1.1 and master commit 530dbfa3 Description The issue is related to out-of-bounds write vulnerabilities in the ORCA format nAtoms functionality. A specially-crafted malformed file can lead to arbitrary code execution. An...
PT-2023-14271
Name of the Vulnerable Software and Affected Versions Open Babel versions 3.1.1 and prior to the version that includes the fix for this issue Description An out-of-bounds write issue exists in the MOL2 format attribute and value functionality. A specially crafted malformed file can lead to...
PT-2023-7022
Name of the Vulnerable Software and Affected Versions Open Babel versions 3.1.1 and master commit 530dbfa3 Description The issue is related to out-of-bounds write vulnerabilities in the translationVectors parsing functionality, which can be triggered by a specially-crafted malformed file. This ca...
GHSA-9436-3GMP-4F53 grav Server-side Template Injection (SSTI) mitigation bypass
Summary The fix for SSTI using |map, |filter and |reduce twigs implemented in the commit 71bbed1 introduces bypass of the denylist due to incorrect return value from isDangerousFunction, which allows to execute the payload prepending double backslash \ Details The isDangerousFunction check in...
Important: libtiff
Issue Overview: LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3488, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. CVE-2023-0795 LibTIFF 4.4.0 has an...
CVE-2023-37477
1Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel firewall functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger...
Cross site scripting
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting XSS. Since the Export Chat feature...
CVE-2023-37259 Cross site scripting in Export Chat feature
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting XSS. Since the Export Chat feature...
CVE-2023-37259 Cross site scripting in Export Chat feature
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting XSS. Since the Export Chat feature...
CVE-2023-37266
CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as root on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit 705bf1f...
Design/Logic Flaw
CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as root on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit 705bf1f...
CVE-2023-37266 Weak json web token (JWT) secrets in CasaOS
CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as root on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit 705bf1f...
CVE-2023-37266 Weak json web token (JWT) secrets in CasaOS
CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as root on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit 705bf1f...
AZL-28509 CVE-2023-37769 affecting package pixman 0.42.2-1
stress-test master commit e4c878 was discovered to contain a FPE vulnerability via the component combineinner at /pixman-combine-float.c...
DEBIAN-CVE-2023-37769
stress-test master commit e4c878 was discovered to contain a FPE vulnerability via the component combineinner at /pixman-combine-float.c...
DEBIAN-CVE-2023-37770
faust commit ee39a19 was discovered to contain a stack overflow via the component boxppShared::print at /boxes/ppbox.cpp...
