CVE-2023-53817

CVE-2023-53817 affects the Linux kernel in crypto: lib/mpi, where mpi_cmp_ui() can dereference a null pointer due to a DH validation path used in NVMe/TCP authentication. The advisory notes an attacker could trigger a kernel oops by negotiating an 8192-bit DH group and supplying a correctly sized...

CVE-2023-53817

In the Linux kernel, the following vulnerability has been resolved: crypto: lib/mpi - avoid null pointer deref in mpicmpui During NVMeTCP Authentication a controller can trigger a kernel oops by specifying the 8192 bit Diffie Hellman group and passing a correctly sized, but zeroed Diffie Hellamn...

PT-2026-32971

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 10.4-rc-1 through 16.10.15 XWiki Platform versions 17.0.0-rc-1 through 17.4.7 XWiki Platform versions 17.5.0-rc-1 through 17.10.0 Description A reflected cross-site scripting XSS issue in the comparison view between pag...

kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare

A slab-out-of-bounds exists in the linux kernel in efivarfsdcompare, such that the issue can be triggered by parallel lookups using an invalid filename due to an incorrect memcmp function...

kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare

A slab-out-of-bounds exists in the linux kernel in efivarfsdcompare, such that the issue can be triggered by parallel lookups using an invalid filename due to an incorrect memcmp function...

kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare

A slab-out-of-bounds exists in the linux kernel in efivarfsdcompare, such that the issue can be triggered by parallel lookups using an invalid filename due to an incorrect memcmp function...

Malicious code in compare-obj (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1892ab55a1dcdd44c7f030aef1ae76a865ffffe4b7a0d4a0492696c149db2e4d The package compare-obj was found to contain malicious code. Source: ghsa-malware 3a7310cc13d858af4c2dfc25ec5d42cf6aa52b00dd7fc28ba0ee069a68e7551b An...

EUVD-2025-199093

Malicious code in compare-obj npm...

MAL-2025-190950 Malicious code in compare-obj (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1892ab55a1dcdd44c7f030aef1ae76a865ffffe4b7a0d4a0492696c149db2e4d The package compare-obj was found to contain malicious code. Source: ghsa-malware 3a7310cc13d858af4c2dfc25ec5d42cf6aa52b00dd7fc28ba0ee069a68e7551b An...

CVE-2025-13268 Dromara dataCompare JDBC URL DbconfigServiceImpl.java DbConfig injection

A flaw has been found in Dromara dataCompare up to 1.0.1. The affected element is the function DbConfig of the file src/main/java/com/vince/xq/project/system/dbconfig/service/DbconfigServiceImpl.java of the component JDBC URL Handler. Executing manipulation can lead to injection. The attack can b...

CVE-2025-64753

grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing hashes for versions of that document and receive a full list of changes between versions, even if those changes contained cells, columns, or...

CVE-2025-64753

grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing hashes for versions of that document and receive a full list of changes between versions, even if those changes contained cells, columns, or...

CVE-2025-64753 grist-core has insufficient access control in endpoints for comparisons between documents and versions

grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing hashes for versions of that document and receive a full list of changes between versions, even if those changes contained cells, columns, or...

EUVD-2025-177187

grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing hashes for versions of that document and receive a full list of changes between versions, even if those changes contained cells, columns, or...

CVE-2025-64753

CVE-2025-64753 Summary : Grist-core versions prior to 1.7.7 expose the full version history and change details to users with partial read access via the /compare endpoint. Root cause: insufficient access control on document/version comparisons. Impact: disclosure of changes that may include data ...

CVE-2025-64753 grist-core has insufficient access control in endpoints for comparisons between documents and versions

grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing hashes for versions of that document and receive a full list of changes between versions, even if those changes contained cells, columns, or...

CVE-2025-64753 grist-core has insufficient access control in endpoints for comparisons between documents and versions

grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing hashes for versions of that document and receive a full list of changes between versions, even if those changes contained cells, columns, or...

PT-2025-46917

Name of the Vulnerable Software and Affected Versions grist-core versions prior to 1.7.7 Description grist-core is a spreadsheet hosting server. A user with limited read access to a document could access endpoints that reveal hashes for different versions of the document and obtain a complete lis...

PT-2025-46841

A vulnerability has been found in mruby up to 3.4.0. This vulnerability affects the function sort cmp of the file src/array.c. Such manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The name of the patch is...

mruby 资源管理错误漏洞

mruby is a lightweight implementation of the Ruby language open-sourced by makesoftwaresafe. A resource management error vulnerability exists in mruby 3.4.0 and earlier versions, which stems from a post-release reuse issue with the sortcmp function in the file src/array.c. The vulnerability is...