GHSA-PM3M-32R3-7MFH Etcd embed auto compaction retention negative value causing a compaction loop or a crash

Impact Data Validation Detail The parseCompactionRetention function in embed/etcd.go allows the retention variable value to be negative and causes the node to execute the history compaction in a loop, taking more CPU than usual and spamming logs. References Find out more on this vulnerability in...

Etcd embed auto compaction retention negative value causing a compaction loop or a crash

Impact Data Validation Detail The parseCompactionRetention function in embed/etcd.go allows the retention variable value to be negative and causes the node to execute the history compaction in a loop, taking more CPU than usual and spamming logs. References Find out more on this vulnerability in...

Etcd embed auto compaction retention negative value causing a compaction loop or a crash

Data Validation...

Etcd embed auto compaction retention negative value causing a compaction loop or a crash

Impact Data Validation Detail The parseCompactionRetention function in embed/etcd.go allows the retention variable value to be negative and causes the node to execute the history compaction in a loop, taking more CPU than usual and spamming logs. References Find out more on this vulnerability in...

GHSA-8JC3-5P29-QGJX PHPMailer Local file inclusion

Impact Arbitrary local file inclusion via the $lang property, remotely exploitable if host application passes unfiltered user data into that property. The 3 CVEs listed are applications that used PHPMailer that were vulnerable to this problem. Patches It's not known exactly when this was fixed in...

PHPMailer Shell command injection

PHPMailer before 1.7.4, when configured to use sendmail, allows remote attackers to execute arbitrary shell commands via shell metacharacters in the SendmailSend function in class.phpmailer.php. Impact Shell command injection, remotely exploitable if host application does not filter user data...

Vyper's external calls can overflow return data to return input buffer

Summary When calls to external contracts are made, we write the input buffer starting at byte 28, and allocate the return buffer to start at byte 0 overlapping with the input buffer. When checking RETURNDATASIZE for dynamic types, the size is compared only to the minimum allowed size for that typ...

CVE-2024-24560 Vyper external calls can overflow return data to return input buffer

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. When calls to external contracts are made, we write the input buffer starting at byte 28, and allocate the return buffer to start at byte 0 overlapping with the input buffer. When checking RETURNDATASIZE for dynamic...

The vulnerability of Microsoft Edge browser, related to insufficient validation of input data, allows attackers to trigger a service failure.

The vulnerability of Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of Microsoft Edge browser, related to insufficient validation of input data, allows attackers to trigger a service failure.

The vulnerability of Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure...

Tenda AC10U fromAddressNat function stack buffer overflow vulnerability

Tenda AC10U is a wireless router from Tenda China. A buffer overflow vulnerability exists in Tenda AC10U version 15.03.06.49multiTDE01, which is caused by the Entrys/mitInterface/page parameter of the fromAddressNat function failing to correctly validate the length of the input data, and can be...

FreeBSD : qt6-webengine -- Multiple vulnerabilities (a25b323a-bed9-11ee-bdd6-4ccc6adda413)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the a25b323a-bed9-11ee-bdd6-4ccc6adda413 advisory. - Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker...

Tenda AC10U fromDhcpListClient Function Stack Buffer Overflow Vulnerability

The Tenda AC10 is a wireless router from the Chinese company Tenda. The Tenda AC10U fromDhcpListClient function suffers from a stack buffer overflow vulnerability, which arises from the page/listN parameter of the fromDhcpListClient function failing to properly validate the length of the input...

The vulnerability in Intel NUC’s built-in software arises from insufficient checking of input data, allowing attackers to exploit their privileges.

The vulnerability of Intel NUC’s built-in software is related to insufficient testing of input data. Exploiting this vulnerability can allow attackers to gain increased privileges...

The vulnerability of Synology RT6600ax router microprogramming software arises from insufficient validation of input data, allowing a hacker to execute arbitrary code.

The vulnerability of Synology RT6600ax router microprogramming software exists due to insufficient verification of input data. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of the AIX operating system, related to insufficient validation of input data, allows a perpetrator to trigger a service failure.

The vulnerability of the AIX operating system is related to insufficient checking of input data. Exploiting this vulnerability can allow an attacker to cause service failures...

The vulnerability of the Filesystem component in Oracle Solaris allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Filesystem component in Oracle Solaris is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the Libarchive library in the Windows operating system, allowing a hacker to execute arbitrary code

The vulnerability of the Libarchive library in the Windows operating system is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

CVE-2024-20272

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system and execute commands on the underlying operating system. This vulnerability is due to a lack of authentication in a...

CVE-2024-20272

CVE-2024-20272 affects Cisco Unity Connection. An unauthenticated attacker can exploit a lack of authentication in a specific API and improper validation to upload arbitrary files, potentially storing malicious files, executing commands on the underlying OS, and elevating privileges to root. Cisc...