6762 matches found
CVE-2025-23039 Cross Site Scripting on URL decode Tooltip in Caido
Caido is a web security auditing toolkit. A Cross-Site Scripting XSS vulnerability was identified in Caido v0.45.0 due to improper sanitization in the URL decoding tooltip of HTTP request and response editors. This issue could allow an attacker to execute arbitrary scripts, potentially leading to...
CVE-2025-23039: Improper Neutralization of Input During Web Page Generation
Caido is a web security auditing toolkit. A Cross-Site Scripting XSS vulnerability was identified in Caido v0.45.0 due to improper sanitization in the URL decoding tooltip of HTTP request and response editors. This issue could allow an attacker to execute arbitrary scripts, potentially leading to...
Caido cross-site scripting vulnerabilities
caido is an open source application from Caido. Designed to help security professionals and enthusiasts audit Web applications efficiently and easily. A cross-site scripting vulnerability exists in Caido version v0.45.0 that stems from improper cleanup in the URL decoding tooltip of the HTTP...
PT-2025-3302 · Unknown +2 · Matrix Media Repo +4
Name of the Vulnerable Software and Affected Versions: Matrix Media Repo versions prior to 1.3.8 Description: The issue arises when SVG or JPEGXL thumbnailers are enabled, allowing a user to upload a file that claims to be one of these types and request a thumbnail, potentially invoking a differe...
BIT-PHP-MIN-2021-21707 Special characters break path parsing in XML functions
In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexmlloadfile, URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the...
PT-2026-2938
Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.20.1 Description FreeRDP, a free implementation of the Remote Desktop Protocol, contains a flaw related to Base64 decoding. A global-buffer-overflow can occur due to implementation-defined char signedness on...
Git security vulnerabilities
Git is a free, open source distributed version control system open-sourced by Git. Git has a security vulnerability that stems from the fact that any URL-encoded portion can be decoded...
skia:animated_image_decode: Use-of-uninitialized-value in decompress_smooth_data
Project: https://skia.googlesource.com/skia.git Detailed Report: https://oss-fuzz.com/testcase?key=4573919847186432 Project: skia Fuzzing Engine: libFuzzer Fuzz Target: animatedimagedecode Job Type: libfuzzermsanskia Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...
CVE-2024-55628
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.8, DNS resource name compression can lead to small DNS messages containing very large hostnames which can be costly to decode, and lead to very large DNS log...
Stack Overflow
github.com/cosmos/cosmos-sdk, cosmossdk.io/x/tx is vulnerable to Stack overflow. The vulnerability is due to improper handling of transaction decoding in Cosmos SDK, allows for excessive resource consumption or stack overflow when processing transactions, potentially leading to system instability...
CVE-2024-56828
File Upload vulnerability in ChestnutCMS through 1.5.0. Based on the code analysis, it was determined that the /api/member/avatar API endpoint receives a base64 string as input. This string is then passed to the memberService.uploadAvatarByBase64 method for processing. Within the service, the...
Suricata security vulnerabilities
Suricata is a network IDS, IPS and NSM engine from the Open Information Security Foundation. A security vulnerability exists in Suricata versions prior to 7.0.8 that stems from the fact that DNS resource name compression may result in small DNS messages containing very large contained hostnames...
PT-2025-11968
Name of the Vulnerable Software and Affected Versions Suricata versions affected versions not specified Description The issue concerns a problem where the decode base64 signature can cause large memory allocation. This could potentially lead to issues with the Suricata package in Debian Linux...
opencv:core_fuzzer: Heap-buffer-overflow in cv::PngDecoder::read_from_io
Project: https://github.com/opencv/opencv.git Detailed Report: https://oss-fuzz.com/testcase?key=6306609613045760 Project: opencv Fuzzing Engine: libFuzzer Fuzz Target: corefuzzer Job Type: libfuzzerasanopencv Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x50200000023...
CVE-2020-1822
There are multiple out of bounds OOB read vulnerabilities in the implementation of the Common Open Policy Service COPS protocol of some Huawei products. The specific decoding function may occur out-of-bounds read when processes an incoming data packet. Successful exploit of these vulnerabilities...
CVE-2020-1820
There are multiple out of bounds OOB read vulnerabilities in the implementation of the Common Open Policy Service COPS protocol of some Huawei products. The specific decoding function may occur out-of-bounds read when processes an incoming data packet. Successful exploit of these vulnerabilities...
SUSE CVE-2024-53146
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent a potential integer overflow If the tag length is = U32MAX - 3 then the "length + 4" addition can result in an integer overflow. Address this by splitting the decoding into several steps so that decodecbcompound4res...
CVE-2020-1824: Out-of-bounds Read
There are multiple out of bounds OOB read vulnerabilities in the implementation of the Common Open Policy Service COPS protocol of some Huawei products. The specific decoding function may occur out-of-bounds read when processes an incoming data packet. Successful exploit of these vulnerabilities...
OESA-2024-2587 golang security update
. Security Fixes: Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.CVE-2024-34155 Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a...
