edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message

A security flaw involving buffer overflow was identified in EDK2, the open-source reference implementation of the UEFI specification. This vulnerability enables an unauthorized attacker within the vicinity network to transmit a specifically crafted DHCPv6 proxy Advertise message, resulting in the...

The vulnerability of the Adobe Photoshop graphic editor relates to overflow of the buffer in dynamic memory, allowing a hacker to execute arbitrary code.

The vulnerability of the Adobe Photoshop graphic editor is related to overflow of the buffer in dynamic memory. Exploiting this vulnerability allows an attacker to execute arbitrary code in the context of the current user, using a specially created malicious file...

[SECURITY] Fedora 41 Update: libell-0.69-1.fc41

The Embedded Linux Library ELL provides core, low-level functionality for system daemons. It typically has no dependencies other than the Linux kernel, C standard library, and libdl for dynamic linking. While ELL is designed to be efficient and compact enough for use on embedded Linux platforms, ...

VulnCheck KEV: CVE-2023-50386

Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1. In the affected...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that results from not properly checking dynamic memory allocations...

The vulnerability of the DHCP server service for Windows operating systems allows a perpetrator to trigger a service failure.

The vulnerability of the Remote Desktop Licensing Service for Windows operating systems is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability of the PDFium PDF-content processor in Microsoft Edge and Google Chrome browsers allows a hacker to execute arbitrary code.

The vulnerability of the PDFium PDF-content processing component in Microsoft Edge and Google Chrome browsers is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created PDF file...

GHSA-GP8F-8M3G-QVJ9 Next.js Cache Poisoning

Impact By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router this does not affect the app router. When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a...

GHSA-64VR-G452-QVP3 Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS

Summary We discovered a DOM Clobbering vulnerability in Vite when building scripts to cjs/iife/umd output format. The DOM Clobbering gadget in the module can lead to cross-site scripting XSS in web pages where scriptless attacker-controlled HTML elements e.g., an img tag with an unsanitized name...

The vulnerability of the do_search() function in the Vim text editor allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the dosearch function in the Vim text editor is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Microsoft SQL Server Masked Data Exposure

Title: SQL Server Masked Data Exposure Through Brute Force Attack Product: Database Manufacturer: Microsoft Affected Versions: SQL Server 2014, 2016,2017,2019,2022 Tested Versions: SQL Server 2014, 2016,2017,2019,2022 Risk Level: Low Security Feature: Dynamic Data Masking Author of Advisory: Emad...

The vulnerability of Adobe After Effects’ video and dynamic image editing software lies in the possibility of an operation going beyond the buffer in memory, allowing a hacker to execute arbitrary code.

The vulnerability of Adobe After Effects video and dynamic image editing software relates to the execution of operations beyond buffer boundaries in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code in the context of the current user, using a specially created...

The vulnerability of Adobe After Effects’ video and dynamic image editing software lies in buffer overflows in its dynamic memory, allowing attackers to execute arbitrary code.

The vulnerability of Adobe After Effects video and dynamic image editing software relates to buffer overflow in dynamic memory. Exploiting this vulnerability allows an attacker to execute arbitrary code in the context of the current user, using a specially created malicious file...

PT-2024-39236 · Acronis · Acronis Cyber Protect 16 +1

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect Cloud Agent Windows versions before build 38235 Acronis Cyber Protect 16 Windows versions before build 39169 Description: A DLL hijacking vulnerability can lead to local privilege escalation. This issue affects Acronis...

PT-2024-25642

Name of the Vulnerable Software and Affected Versions Acronis Cyber Protect Cloud Agent Windows versions before build 38235 Description A local privilege escalation issue exists due to a DLL hijacking vulnerability. This can cause local privilege escalation. Recommendations For Acronis Cyber...

Acronis Cyber Protect 代码问题漏洞

Acronis Cyber Protect is an all-in-one cyber protection solution for business and enterprise from Acronis Switzerland. Combining backup, anti-malware, network security and endpoint management features such as vulnerability assessment, URL filtering, patch management and more. A code issue...

OSV-2024-1071 Use-of-uninitialized-value in Poco::Dynamic::Var::~Var

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538385 Crash type: Use-of-uninitialized-value Crash state: Poco::Dynamic::Var::Var void Poco::JSON::Object::doStringifystd::1::mapstd::1::basicstringchar, Poco::JWT::Serializer::serialize...

PT-2024-40574 · Poco · Poco

Name of the Vulnerable Software and Affected Versions: Poco affected versions not specified Description: The issue is related to a crash caused by the use of an uninitialized value. The crash occurs in the Poco::Dynamic::Var destructor and is associated with the Poco::JSON::Object::doStringify...

The vulnerability of the Microsoft Office suite relates to buffer overflows in dynamic memory, allowing an attacker to execute arbitrary code.

The vulnerability of the Microsoft Office suite is related to overflowing buffers in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the iCUEUpdateService service in the CORSAIR iCUE management system allows a hacker to elevate their privileges.

The vulnerability of the iCUEUpdateService service in the CORSAIR iCUE management system is related to insufficient protection of service data due to the loading of dynamic libraries MSASN1.dll, NTASN1.dll, and profapi.dll into the \cuepkg-1.2.6 directory. Exploiting this vulnerability can allow...