12346 matches found
OESA-2023-1110 c-ares security update
Security Fixes: In aressetsortlist, it calls configsortlist..., sortstr to parse the input str and initialize a sortlist configuration. However, aressetsortlist has not any checks about the validity of the input str. It is very easy to create an arbitrary length stack overflow with the unchecked...
PT-2025-38038
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The mpi3mr get all tgt info function contains several issues. The function incorrectly calculates the valid entry length in alltgt info by assuming an incorrect size for the header of th...
CVE-2021-32854: Improper Neutralization of Input During Web Page Generation
textAngular is a text editor for Angular.js. Version 1.5.16 and prior are vulnerable to copy-paste cross-site scripting XSS. For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. There are no known patches...
PT-2023-12186 · Unknown · Textangular
Name of the Vulnerable Software and Affected Versions: textAngular versions 1.5.16 and prior Description: The issue is related to copy-paste cross-site scripting XSS in textAngular, a text editor for Angular.js. For this particular type of XSS, the victim needs to be fooled into copying a malicio...
CVE-2021-32854
textAngular is a text editor for Angular.js. Version 1.5.16 and prior are vulnerable to copy-paste cross-site scripting XSS. For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. There are no known patches...
CVE-2021-32855: Improper Neutralization of Input During Web Page Generation
Vditor is a browser-side Markdown editor. Versions prior to 3.8.7 are vulnerable to copy-paste cross-site scripting XSS. For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. Version 3.8.7 contains a patch for this issue...
CVE-2021-32856: Improper Neutralization of Input During Web Page Generation
Microweber is a drag and drop website builder and content management system. Versions 1.2.12 and prior are vulnerable to copy-paste cross-site scripting XSS. For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. A fix was attempted i...
CVE-2021-32854 textAngular text editor vulnerable to Cross-site Scripting
textAngular is a text editor for Angular.js. Version 1.5.16 and prior are vulnerable to copy-paste cross-site scripting XSS. For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. There are no known patches...
CVE-2021-32854
The CVE-2021-32854 issue affects textAngular (Angular.js) versions 1.5.16 and earlier, due to a copy-paste cross-site scripting (XSS) flaw in the editor. The root cause is an XSS vulnerability triggered when a user pastes malicious payloads into the text editor. No patched versions are identified...
PT-2023-12188 · Unknown · Microweber
Name of the Vulnerable Software and Affected Versions: Microweber versions 1.2.12 and prior Description: The issue concerns a copy-paste cross-site scripting XSS flaw. This type of XSS requires the victim to be tricked into copying a malicious payload into the text editor. Recommendations: For...
CVE-2021-32855
Vditor is a browser-side Markdown editor. Versions prior to 3.8.7 are vulnerable to copy-paste cross-site scripting XSS. For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. Version 3.8.7 contains a patch for this issue...
Zyxel Router Buffer Overflow DoS
The vulnerability of Zyxel router microprogramming software lies in the copying of buffers without checking the size of input data during the processing of web server parameters. Exploiting this vulnerability allows a malicious actor to cause service failures by sending specially crafted requests...
OESA-2023-1091 c-ares security update
This is c-ares, an asynchronous resolver library. It is intended for applications which need to perform DNS queries without blocking, or need to perform multiple Security Fixes: In aressetsortlist, it calls configsortlist..., sortstr to parse the input str and initialize a sortlist configuration...
CVE-2022-32469
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the PnpSmm shared buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This attack can be mitigated using IOMMU...
SUSE CVE-2004-0075
The Vicam USB driver in Linux before 2.4.25 does not use the copyfromuser function when copying data from userspace to kernel space, which crosses security boundaries and allows local users to cause a denial of service...
SUSE CVE-2004-0832
The 1 ntlmfetchstring and 2 ntlmgetstring functions in Squid 2.5.6 and earlier, with NTLM authentication enabled, allow remote attackers to cause a denial of service application crash via an NTLMSSP packet that causes a negative value to be passed to memcpy...
SUSE CVE-2005-0530
Signedness error in the copyfromreadbuf function in ntty.c for Linux kernel 2.6.10 and 2.6.11rc1 allows local users to read kernel memory via a negative argument...
SUSE CVE-2006-0225
scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice...
SUSE CVE-2006-1523
The groupcompletesignal function in the RCU signal handling signal.c in Linux kernel 2.6.16, and possibly other versions, has unknown impact and attack vectors related to improper use of BUGON...