935 matches found
PT-2022-16879 · Vyper · Vyper
Name of the Vulnerable Software and Affected Versions: Vyper versions 0.3.1 and prior Description: The issue arises from the comparison of bytestrings, which can yield incorrect results due to the presence of dirty bytes or the lack of length comparison. Specifically, two bytestrings can compare ...
WordPress Compare Affiliated Products plugin <= 2.2.0 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Compare Affiliated Products plugin versions = 2.2.0. Solution No patched version available...
PT-2022-28891
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.5 Description The issue is related to the use of a compare-exchange operation to set the KASAN page tag. It was introduced in version v5.0 and fixed in version v5.16.5. The actual impact and attack...
GSD-2022-1000252 mm, kasan: use compare-exchange operation to set KASAN page tag
mm, kasan: use compare-exchange operation to set KASAN page tag This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.19 by commit...
PT-2022-28530
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.19 Description The issue is related to the use of a compare-exchange operation to set the KASAN page tag. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...
compare-eslint-config (>=0.1.0, <=0.1.1) potentially affected by CVE-2020-7629 via install-package (0.1.0)
install-package NPM version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on install-package and may be impacted: - compare-eslint-config =0.1.0, =0.1.1 Source cves: CVE-2020-7629 Source advisory: OSV:GHSA-6M4R-M3GC-H4R5...
php:php-fuzz-execute: Use-of-uninitialized-value in string_case_compare_function
Detailed Report: https://oss-fuzz.com/testcase?key=5164925062873088 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-execute Job Type: libfuzzermsanphp Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: stringcasecomparefunction...
CVE-2021-46170
An issue was discovered in JerryScript commit a6ab5e9. There is an Use-After-Free in lexercompareidentifiertostring in js-lexer.c file...
UBUNTU-CVE-2021-46170
An issue was discovered in JerryScript commit a6ab5e9. There is an Use-After-Free in lexercompareidentifiertostring in js-lexer.c file...
PT-2022-12602
Name of the Vulnerable Software and Affected Versions JerryScript version a6ab5e9 Description An issue was discovered in the js-lexer.c file, specifically in the lexer compare identifier to string function, where there is a Use-After-Free. Recommendations For JerryScript version a6ab5e9, consider...
MGASA-2021-0582 Updated ldns packages fix security vulnerability
Heap out-of-bound read vulnerability in rrfrmstrinternal function Heap out-of-bound read vulnerability in ldnsnsec3saltdata function Fixed time memory compare for Openssl 0.9.8...
PT-2021-30877
Name of the Vulnerable Software and Affected Versions Openssl version 0.9.8 Description The issue involves a heap out-of-bound read vulnerability in the rr frm str internal function and the ldns nsec3 salt data function. Additionally, there is a fixed time memory compare issue. Recommendations Fo...
GHSA-GV87-Q66H-4277 Command injection in itext7-core
iTextPDF in iText before 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs aka Ghostscript command line in GhostscriptHelper.java...
Command Injection
Overview com.itextpdf:itextpdf is a software developer toolkit that allows users to integrate PDF functionalities within their applications, processes or products. Affected versions of this package are vulnerable to Command Injection. An attacker controlling the filename passed to the CompareTool...
PT-2021-23745
Name of the Vulnerable Software and Affected Versions iText versions prior to 7.1.17 Description The issue allows command injection via a CompareTool filename that is mishandled on the gs aka Ghostscript command line in GhostscriptHelper.java. This can occur when a malicious filename is provided ...
CVE-2022-38145 - Stored XSS in Compare Mode
More info at https://www.silverstripe.org/download/security-releases/cve-2022-38145...
Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition
Summary Java SE issues disclosed in the Oracle July 2021 Critical Patch Update Vulnerability Details CVEID: CVE-2021-2388 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to take control of the system. CVSS Base score: 7.5 CV...
Security Bulletin: CVE-2021-2341 may affect IBM® SDK, Java™ Technology Edition
Summary CVE-2021-2341 was disclosed as part of the Oracle July 2021 Critical Patch Update. Vulnerability Details CVEID: CVE-2021-2341 DESCRIPTION: An unspecified vulnerability in Java SE related to the Networking component could allow an unauthenticated attacker to obtain sensitive information...
Security Bulletin: Multiple vulnerabilities in Apache Commons* affect Tivoli Netcool/OMNIbus WebGUI (CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090)
Summary Fix is available for vulnerabilities in Apache Commons affecting Tivoli Netcool/OMNIbus WebGUI CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090. Vulnerability Details CVEID: CVE-2021-35517 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by a...
Security Bulletin: WebSphere Application Server is vulnerable to Information Disclosure (CVE-2021-29842)
Summary WebSphere Application Server configured with a federated repository is vulnerable to information disclosure. This has been addressed. Vulnerability Details CVEID: CVE-2021-29842 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could...