oFono 安全漏洞

oFono is an open source telephony communication framework open-sourced by UBports. A security vulnerability exists in oFono versions prior to 2.1, which stems from a stack overflow error triggered by the decodesubmitreport function during SMS decoding...

CVE-2023-44854

Cross Site Scripting XSS vulnerability in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the csetrslogdecode function in the acuweb file...

CVE-2023-44852

Cross Site Scripting XSS vulnerability in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the csettrapsdecode function in the acuweb file...

PT-2024-13203 · Cobham · Cobham Sailor Vsat Ku

Name of the Vulnerable Software and Affected Versions: Cobham SAILOR VSAT Ku version 164B019 Description: The issue is related to a Cross Site Scripting XSS vulnerability, which allows a remote attacker to execute arbitrary code via a crafted script to the c set rslog decode function in the acu w...

CVE-2024-31386

Cross-Site Request Forgery CSRF vulnerability in Hidekazu Ishikawa X-T9, Hidekazu Ishikawa Lightning, themeinwp Default Mag, Out the Box Namaha, Out the Box CityLogic, Marsian i-max, Jetmonsters Emmet Lite, Macho Themes Decode, Wayneconnor Sliding Door, Out the Box Shopstar!, Modernthemesnet...

CVE-2024-31386 Multiple WordPress themes affected by Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery CSRF vulnerability in Hidekazu Ishikawa X-T9, Hidekazu Ishikawa Lightning, themeinwp Default Mag, Out the Box Namaha, Out the Box CityLogic, Marsian i-max, Jetmonsters Emmet Lite, Macho Themes Decode, Wayneconnor Sliding Door, Out the Box Shopstar!, Modernthemesnet...

WordPress Decode theme <= 3.15.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Theme Decode versions = 3.15.3...

WordPress Decode Theme <= 3.15.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Decode Type Theme Vulnerable versions = 3.15.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31386 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID cf688734f247 Credits Dhabaleshwar Das Required...

CVE-2024-31386: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Hidekazu Ishikawa X-T9, Hidekazu Ishikawa Lightning, themeinwp Default Mag, Out the Box Namaha, Out the Box CityLogic, Marsian i-max, Jetmonsters Emmet Lite, Macho Themes Decode, Wayneconnor Sliding Door, Out the Box Shopstar!, Modernthemesnet...

The vulnerability of the decode_uncompressed_image() function, a decoder and file format encoder for the libheif library, allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the decodeuncompressedimage function, a decoder and file format encoder for the libheif library, is related to a segmentation error. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

net/http, x/net/http2: close connections when receiving too many headers

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

CVE-2023-45288

The golang runtime (specifically within the net/http and x/net/http2 packages) is vulnerable to a Denial of Service (DoS) condition. An attacker can exploit this by sending an excessive number of CONTINUATION frames to an HTTP/2 endpoint. Because the system continues to parse and process these fr...

PT-2024-40685 · Git +1 · Openh264

Name of the Vulnerable Software and Affected Versions: Open-source software affected versions not specified Description: The issue is related to a crash caused by the use of an uninitialized value. The crash occurs in the WelsDec::CWelsDecoder class, specifically in the ReorderPicturesInDisplay,...

PT-2024-11215 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to an incorrect limit in the filelayout decode layout function, where the size of struct nfs fh is two bytes too large, potentially leading to memory corruption. T...

CLSA-2024-1710786990 Fix CVE(s): CVE-2024-0727

SECURITY UPDATE: Potential Denial of Service via processing maliciously formatted PKCS12 file - debian/patches/CVE-2024-0727.patch: Fix decode error causing NULL pointer in PKCS12unpackp7data, PKCS12unpackp7encdata, PKCS12unpackauthsafes, SMIMEwritePKCS7, pkcs12genmac and newpassp12 functions -...

SUSE CVE-2023-52491

In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: Fix use after free bug due to error path handling in mtkjpegdecdevicerun In mtkjpegprobe, &jpeg-jobtimeoutwork is bound with mtkjpegjobtimeoutwork. In mtkjpegdecdevicerun, if error happens in mtkjpegsetdecdst, it...

PT-2024-21756 · Google · Android

Name of the Vulnerable Software and Affected Versions: LPP LcsManagement.c affected versions not specified Description: The issue is related to a possible out of bounds read in the EUTRAN LCS DecodeFacilityInformationElement function of LPP LcsManagement.c due to a missing bounds check. This coul...

Google Pixel Security Breach

Google Pixel is a smartphone from Google Inc. in the United States. A security vulnerability exists in Google Pixel, which stems from a missing bounds check in the EUTRANLCSDecodeFacilityInformationElement method of the LPPLcsManagement.c file, which may result in out-of-bounds reads...

[SECURITY] Fedora 40 Update: json_simple-1.1.1-34.fc40

JSON.simple is a simple Java toolkit for JSON. You can use JSON.simple to encode or decode JSON text. Full compliance with JSON specification RFC4627 and reliable Provides multiple functionalities such as encode, decode/parse and escape JSON text while keeping the library lightweight Flexible,...

PT-2024-40652 · Aom · Aom

Name of the Vulnerable Software and Affected Versions: aom affected versions not specified Description: The issue is related to a heap-use-after-free error, which occurs when the program attempts to access memory that has already been freed. This error is identified in the get ls tile buffers...