2469 matches found
CVE-2023-37913 org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 3.5-milestone-1 and prior to versions 14.10.8 and 15.3-rc-1, triggering the office converter with a specially crafted file name allows writing the attachment's content to a...
CVE-2023-37913 org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 3.5-milestone-1 and prior to versions 14.10.8 and 15.3-rc-1, triggering the office converter with a specially crafted file name allows writing the attachment's content to a...
XWiki Platform Path Traversal Vulnerability
XWiki Platform is a suite of Wiki platforms for creating Web collaboration applications from the XWiki Foundation in France. A security vulnerability exists in XWiki Platform that stems from the use of specially crafted filenames to trigger an Office converter to allow the contents of an attachme...
PT-2023-26181 · Xwiki · Xwiki Platform
Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 3.5-milestone-1 through 14.10.7 XWiki Platform versions 15.3-rc-1 and earlier Description: Triggering the office converter with a specially crafted file name allows writing the attachment's content to an...
Malvertisers Using Google Ads to Target Users Searching for Popular Software
Details have emerged about a malvertising campaign that leverages Google Ads to direct users searching for popular software to fictitious landing pages and distribute next-stage payloads. Malwarebytes, which discovered the activity, said it's "unique in its way to fingerprint users and distribute...
CVE-2023-34050
In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however by default, when no allowed list was provided, all classes...
PT-2023-25244 · Unknown · Darwinn Mlir Converter Aidl.Cc
Name of the Vulnerable Software and Affected Versions: darwinn mlir converter aidl.cc affected versions not specified Description: In the CanConvertPadV2Op function of darwinn mlir converter aidl.cc, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local...
Malicious code in shopify-currency-converter (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cce5f47f0fb8050c5ba0e74637e692ba095f4628070a3087b67db81de6deca0d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8298 Malicious code in shopify-currency-converter (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cce5f47f0fb8050c5ba0e74637e692ba095f4628070a3087b67db81de6deca0d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Hydra Input Validation Error Vulnerability
Hydra is a penetration testing tool. An input validation error vulnerability exists in versions of Hydra prior to 0.12.0, which stems from the commit validator containing a flawed check when using the ViaAbort converter, which allows any user to arbitrarily spend any UTxO on the validator, meanin...
openSUSE 15 Security Update : python-CairoSVG (openSUSE-SU-2023:0272-1)
The remote openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0272-1 advisory. - CairoSVG is a Python pypi package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression...
openSUSE 15 Security Update : python-CairoSVG (openSUSE-SU-2023:0260-1)
The remote openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0260-1 advisory. - CairoSVG is a Python pypi package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression...
The vulnerability of the open_stream function in the file conversion utility for files with the .fig and .fig2dev extensions allows a malicious actor to cause a service failure by writing beyond the buffer boundaries in memory.
The vulnerability of the openstream function in the file conversion utility for files with the .fig and .fig2dev extensions is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to cause a service failure...
PT-2023-35995 · Apache · Apache Poi
Name of the Vulnerable Software and Affected Versions: Apache POI affected versions not specified Description: A security exception occurs in the Apache POI library, specifically in the AbstractWordConverter class, when processing certain Word documents. The crash is related to the...
PT-2023-6951 · Microsoft · Exchange Server
Name of the Vulnerable Software and Affected Versions: Microsoft Exchange Server affected versions not specified Description: The issue is related to a deserialization flaw in the Microsoft Exchange Server, specifically with the SerializationTypeConverter class, which can be exploited due to...
PT-2023-6952 · Microsoft · Exchange Server
Name of the Vulnerable Software and Affected Versions: Microsoft Exchange Server affected versions not specified Description: The issue is related to a deserialization mechanism weakness in Microsoft Exchange Server, specifically with the SerializationTypeConverter class, which can lead to...
Google Android 缓冲区错误漏洞
Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that originates from an out-of-bounds read in convertSubgraphFromHAL of ShimConverter.cpp, which can be exploited by an attacker to obtain sensitive...
PT-2023-18054 · Google · Android
Name of the Vulnerable Software and Affected Versions: No specific software name or version is mentioned in the provided descriptions. Description: The issue is related to a missing bounds check in the convertSubgraphFromHAL function of ShimConverter.cpp, which could lead to a possible out of...
USN-6277-2: Dompdf vulnerabilities
USN-6277-1 fixed vulnerabilities in Dompdf. This update provides the corresponding updates for Ubuntu 22.04 LTS. Original advisory details: It was discovered that Dompdf was not properly validating untrusted input when processing HTML content under certain circumstances. An attacker could possibl...