MatrixSSL Security Vulnerability

Inside Secure MatrixSSL is an embedded, open-source SSLv3 stack designed for small applications and devices from Inside Secure, France. A security vulnerability exists in Rambus TLS Toolkit, MatrixSSL versions 4.x through 4.6.0, which stems from a length-subtracting integer overflow in the parsin...

PT-2023-9276 · Qualcomm · Qualcomm Embedded Platform

Name of the Vulnerable Software and Affected Versions: Qualcomm embedded platform software affected versions not specified Description: The issue is related to a memory corruption problem when allocating and accessing an entry in an SMEM partition. It is also described as a vulnerability in the...

CVE-2023-6228

An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash...

Exploit for Path Traversal in Igniterealtime Openfire

CVE-2023-32315 - Openfire Authentication Bypass This reposito...

JetBrains YouTrack Security Vulnerability

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. A security vulnerability exists in versions prior to JetBrains YouTrack 2023.3.22268, which...

Qualcomm Embedded Software Assert Failure

The vulnerability of embedded software developed for Qualcomm chips lies in the improper implementation of the channel bandwidth division mechanism and the switching between subbands when performing Beam Switching. This occurs due to the use of the assert function. Exploiting this vulnerability c...

LibreOffice 7.5 < 7.5.9 / 7.6 < 7.6.3 Improper Input Validation (macOS)

LibreOffice supports embedded videos in file formats via platform audio/video support. Typically under Linux this is via gstreamer. In affected version of LibreOffice the filename of the embedded video is not sufficiently escaped when passed to gstreamer enabling an attacker to run arbitrary...

Qualcomm Embedded Software DoS

The vulnerability of embedded Qualcomm software is related to insufficient validation of input data when receiving messages related to connection configuration from the RRC. Exploiting this vulnerability can allow a remote attacker to cause service failures...

Qualcomm Internal Chips DoS

The vulnerability of the data modem component of Qualcomm’s embedded software is related to incorrect cleaning of the TLB buffer during message processing. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

December 12, 2023—KB5033420 (Monthly Rollup)

December 12, 2023—KB5033420 Monthly Rollup Applies To Windows Server 2012 R2 IMPORTANT The installation of this Extended Security Update ESU might fail when you try to install it on an Azure Arc-enabled device that is running Windows Server 2012 R2. For a successful installation, please make sure...

December 12, 2023—KB5033433 (Monthly Rollup)

December 12, 2023—KB5033433 Monthly Rollup Applies To Windows Server 2008 R2 Enterprise ESU Windows Server 2008 R2 Standard ESU Windows Server 2008 R2 Datacenter ESU Windows Embedded POSReady 7 ESU Note REMINDER As of January 10, 2023, Microsoft no longer provides security updates or technical...

CVE-2023-6185 Improper input validation enabling arbitrary Gstreamer pipeline injection

Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer plugins. In affected versions the filename of the embedded video is not sufficiently escaped when passed to GStreamer enabling an attacker to r...

CVE-2023-6185

Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer plugins. In affected versions the filename of the embedded video is not sufficiently escaped when passed to GStreamer enabling an attacker to r...

PT-2023-28364

Name of the Vulnerable Software and Affected Versions Biller Direct affected versions not specified Description An unauthenticated attacker can embed a hidden access to a Biller Direct URL in a frame which, when loaded by the user, will submit a cross-site scripting request to the Biller Direct...

CVE-2021-46899

SyncTrayzor 1.1.29 enables CEF Chromium Embedded Framework remote debugging, allowing a local attacker to control the application...

CVE-2021-46899

SyncTrayzor 1.1.29 enables CEF Chromium Embedded Framework remote debugging, allowing a local attacker to control the application...

Design/Logic Flaw

SyncTrayzor 1.1.29 enables CEF Chromium Embedded Framework remote debugging, allowing a local attacker to control the application...

SyncTrayzor Security Vulnerability

SyncTrayzor is a small tray utility for Syncthing on Windows. A security vulnerability exists in SyncTrayzor version 1.1.29 that stems from enabling CEF remote debugging, allowing a local attacker to take control of the application...

PT-2023-12619 · Unknown +1 · Synctrayzor +1

Name of the Vulnerable Software and Affected Versions: SyncTrayzor version 1.1.29 Description: The issue allows a local attacker to control the application due to the enabled CEF Chromium Embedded Framework remote debugging. Recommendations: For SyncTrayzor version 1.1.29, consider disabling the...

CVE-2021-46899

CVE-2021-46899 affects SyncTrayzor 1.1.29. The issue arises from enabling Chromium Embedded Framework (CEF) remote debugging, which allows a local attacker to control the application. According to NVD, the CVSSv3.1 base score is 7.8 (HIGH) with LOCAL attack vector, LOW attack complexity, and LOW ...