Red Hat Shim Security Breach

Red Hat Shim is a simple software package from Red Hat. It is intended to be used as a first-stage boot loader on UEFI systems. A security vulnerability exists in Red Hat Shim. An attacker exploiting this vulnerability could cause memory corruption and possibly lead to a bootstrap crash or data...

Insufficient Verification Of Data Authenticity

GitLab CE/EE is vulnerable to Insufficient Verification of Data Authenticity. The vulnerability is caused due to an attacker could potentially modify the metadata of signed commits. This can lead to compromising Integrity of the system...

CVE-2023-40548

A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This fl...

rpm: TOCTOU race in checks for unsafe symlinks

A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and...

The vulnerability of the Splunk Enterprise platform for operational analysis in Windows operating systems lies in the restoration of unreliable data in memory, allowing attackers to compromise the integrity, accessibility, and confidentiality of the protected information.

The vulnerability of the Splunk Enterprise operating system for Windows platform lies in the recovery of unreliable data in memory due to an incorrect path being used to access files on the disk partition. Exploiting this vulnerability can allow an attacker to compromise the integrity,...

The vulnerability of the DHCPv6 Advertise Message Handler component in the Tianocore EDK2 library, which allows a attacker to compromise the confidentiality, integrity, and accessibility of data.

The vulnerability of the DHCPv6 Advertise Message Handler component in the Tianocore EDK2 library is related to buffer overflow attacks. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of data...

The vulnerabilities of the Content Access SDK, Image Export SDK, PDF Export SDK, and HTML Export SDK components of Oracle Outside In Technology’s software development kit (SDK) allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerabilities of the Content Access SDK, Image Export SDK, PDF Export SDK, and HTML Export SDK components of Oracle Outside In Technology’s software development kit SDK exist due to insufficient testing of input data. Exploiting these vulnerabilities can allow attackers to compromise the...

The vulnerability of the JavaFX component of the Oracle Java SE software platform and the Oracle GraalVM Enterprise Edition virtual machine allows attackers to compromise the integrity of protected information.

The vulnerability of the JavaFX component of Oracle Java SE and the Oracle GraalVM Enterprise Edition platform exists due to insufficient testing of input data. Exploiting this vulnerability can allow an attacker to compromise the integrity of protected information...

The vulnerability of the Hotspot component in Oracle Java SE and Oracle GraalVM for JDK/Oracle GraalVM Enterprise Edition virtual machines allows attackers to compromise data integrity.

The vulnerability of the Hotspot component of Oracle Java SE and the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines exists due to insufficient testing of input data. Exploiting this vulnerability can allow an attacker to compromise data integrity remotely...

The vulnerability of the BI Platform Security component of the Oracle Business Intelligence Enterprise Edition software allows attackers to compromise data confidentiality and integrity.

The vulnerability of the BI Platform Security component of the Oracle Business Intelligence Enterprise Edition exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and integrity of data...

The vulnerability of the Core server component of Oracle WebLogic Server, a software platform of Oracle Fusion Middleware, allows attackers to compromise data confidentiality and integrity.

The vulnerability of the Core server component of Oracle WebLogic Server, a software platform of Oracle Fusion Middleware, exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and integrity of data...

The vulnerability of the receive_encrypted_standard() function in the fs/smb/client/smb2ops.c module of the SMB protocol client implementation in Linux operating systems allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the receiveencryptedstandard function in the fs/smb/client/smb2ops.c module, which is part of the SMB protocol client implementation in Linux operating systems, relates to access to memory beyond the allocated buffer due to a numerical overflow. Exploiting this vulnerability...

The vulnerability of the wb inode_writeback_end() function in the mm/page-writeback.c module of the Linux kernel’s memory management subsystem allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the wb inodewritebackend function in the mm/page-writeback.c module of the Linux kernel’s memory management subsystem is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity...

CVE-2023-40548

A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This fl...

PT-2024-1387 · Google +5 · Google Chrome +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 121.0.6167.85 Microsoft Edge affected versions not specified Description: The issue is related to an inappropriate implementation in the Autofill feature, allowing a remote attacker to bypass Autofill...

The vulnerability of the Network Diagnostic Commands function in the microprogramming software of the SmartNode SN200 adapter allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Network Diagnostic Commands function in the microprogramming software of the SmartNode SN200 adapter lies in the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability can allow a remote attacker to...

The vulnerability of the derivate_spatial_luma_vector_prediction function in the h.265 Libde265 implementation allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the derivatespatiallumavectorprediction function in the h.265 Libde265 codec implementation is related to the possibility of writing beyond buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, a...

The vulnerability of the user interface of Juniper Networks Junos OS routers in the MX and EX9200 series allows a attacker to influence the integrity of protected information.

The vulnerability of the user interface of Juniper Networks Junos OS routers in the MX and EX9200 series is related to an improperly implemented payload-protocol function. Exploiting this vulnerability allows a remote attacker to influence the integrity of the protected information...

Request Smuggling org.apache.tomcat:tomcat-catalina Dependency in Confluence Data Center and Server

This High severity org.apache.tomcat:tomcat-catalina Dependency vulnerability was introduced in versions 6.10.0 of Confluence Data Center and Server. This org.apache.tomcat:tomcat-catalina Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

CVE-2024-20950

Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite component: Outcome-Result. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Custom...