Vulnerability of the Server component: The Oracle MySQL Server database management system’s DDL functions allow attackers to cause service interruptions.

Vulnerability of the Server component: The DDL system for managing databases in Oracle MySQL Server has vulnerabilities related to access control. Exploiting this vulnerability can allow an attacker to cause service interruptions using the MySQL protocol...

expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate

A use-after-free flaw was found in the Expat package, caused by destruction of a shared DTD in XMLExternalEntityParserCreate in out-of-memory situations. This may lead to availability disruptions...

The vulnerability of the Apex One NT RealTime Scan (ntrtscan.exe) service of the Trend Micro Apex One and Apex One as a Service antivirus programs allows a malicious actor to execute arbitrary code and gain unauthorized access to protected information.

The vulnerability of the Apex One NT RealTime Scan ntrtscan.exe component of Trend Micro’s Apex One and Apex One as a Service antivirus programs is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability allows an attacker to execute arbitrary code...

CVE-2023-33947

The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by virtual instance in search which allows remote authenticated users in one virtual instance to view object definition from a second virtual instance by searching...

woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks

A flaw was found in the FasterXML/woodstox package. This flaw allows an attacker to cause a denial of service DoS in its target via XML serialization. An attacker may benefit from the parser sending a malicious input that may cause a crash. This vulnerability is only relevant for users using the...

Cross-site Scripting (XSS) in DataObjects QuantityValue Unit Definition

Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Patches Update to version 10.5.21 or apply these patches manually...

AZL-26281 CVE-2023-28484 affecting package libxml2 for versions less than 2.10.4-1

In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c...

PT-2023-2651 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.32 and prior Description: The issue exists due to insufficient input validation in the MySQL Server component, specifically in the Server: DDL subcomponent. This allows a high-privileged attacker with network access...

DEBIAN-CVE-2020-17354

LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated by dangerous Scheme code in a .ly file that causes arbitrary code execution during conversion to a different file format. NOTE: in 2.24 and later versions, sa...

CVE-2023-28150

An issue was discovered in Independentsoft JODF before 1.1.110. The API is prone to XML external entity XXE injection via a remote DTD in a DOCX file...

Independentsoft JSpreadsheet 代码问题漏洞

Independentsoft JSpreadsheet is a Microsoft Excel-compatible API for Java and Android from Independentsoft, Germany. A security vulnerability exists in Independentsoft JSpreadsheet versions prior to 1.1.110, which stems from the API's susceptibility to XML External Entity XXE injection via a remo...

Pimcore 跨站脚本漏洞

Pimcore is Austria's Pimcore company's set of open source for the creation and management of Web applications Web content management platform. The platform integrates Web content management, e-commerce frameworks and product information management applications. A cross-site scripting vulnerabilit...

PT-2023-17026 · Lespeed Wisecleaner · Wisehdinfo64.Dll +1

Name of the Vulnerable Software and Affected Versions: Lespeed WiseCleaner Wise System Monitor version 1.5.3.54 Description: A critical issue has been found, affecting the function 0x9C402088 in the WiseHDInfo64.dll library of the IoControlCode Handler component. This leads to improper access...

PT-2023-35432 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.95 Description: The issue is related to the ALSA hda codec, where the preset is not unset when cleaning up the codec. The actual impact and attack plausibility have not yet been proven. Recommendations: Fo...

The vulnerability of NVIDIA GeForce Experience’s software relates to an incorrect definition of the link before accessing the file, allowing a hacker to delete arbitrary data.

The vulnerability of NVIDIA GeForce Experience software relates to an incorrect definition of the link before accessing the file. Exploiting this vulnerability could allow a remote attacker to delete arbitrary data...

The vulnerability of the Apex One NT RealTime Scan service (ntrtscan.exe), an antivirus software solution provided by Trend Micro’s Apex One, exposes the system to potential threats. This vulnerability allows attackers to gain increased privileges.

The vulnerability of the Apex One NT RealTime Scan ntrtscan.exe component of Trend Micro’s Apex One and Apex One as a Service antivirus programs is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability can allow attackers to increase their...

IBM MQ 输入验证错误漏洞

IBM MQ IBM WebSphere MQ is a messaging middleware product from International Business Machines IBM. The product focuses on providing a reliable, validated messaging backbone for service-oriented architectures SOA. An input validation error vulnerability exists in IBM MQ for HPE NonStop version...

CVE-2022-23540

A flaw was found in the jsonwebtoken library. In affected versions of the jsonwebtoken library, lack of algorithm definition and a falsy secret or key in the jwt.verify function may lead to signature validation bypass due to defaulting to the none algorithm for signature verification...

K8178: MySQL vulnerabilities CVE-2007-5925, CVE-2007-5969, and CVE-2007-6303

Security Advisory Description Note : Versions that are not listed in this article have not been evaluated for vulnerability to this security advisory. For information about the F5 security policy regarding evaluating older and unsupported versions of F5 products, refer to K4602: Overview of the F...

K37611417: Intel Driver vulnerability CVE-2020-12307

Security Advisory Description Improper permissions in some IntelR High Definition Audio drivers before version 9.21.00.4561 may allow an authenticated user to potentially enable escalation of privilege via local access. CVE-2020-12307 Impact There is no impact; F5 products are not affected by thi...