6409 matches found
Ubuntu 18.04 ESM : Netty vulnerabilities (USN-4866-1)
The remote Ubuntu 18.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4866-1 advisory. It was discovered that Netty incorrectly implements HTTP/2. An attacker could possibly use this issue to cause a denial of service. CVE-2019-9512,...
quickjs:fuzz_eval: Nested bug in the same thread, aborting. with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=5147465126641664 Project: quickjs Fuzzing Engine: libFuzzer Fuzz Target: fuzzeval Job Type: libfuzzermsanquickjs Platform Id: linux Crash Type: Nested bug in the same thread, aborting. Crash Address: Crash State: NULL Sanitizer: memory MSAN Crash...
Moderate: Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.3.2 security updates and bug fixes
Multicluster Engine for Kubernetes 2.3.2 General Availability release images, which contain security updates and fix bugs. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
nodejs: HTTP Request Smuggling via Empty headers separated by CR
A vulnerability has been identified in the Node.js, where llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS...
CVE-2023-2315
Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2 allows an authenticated user with access/modify privilege on the Log component to empty out arbitrary files on the server...
Important: haproxy2
Issue Overview: HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and...
PYSEC-2023-305
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. Starting in version 0.2.9 and prior to version 0.3.10, locks of the type @nonreentrant"" or @nonreentrant'' do not produce reentrancy checks at runtime. This issue is fixed in version 0.3.10. As a workaround, ensure...
PYSEC-2023-305
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. Starting in version 0.2.9 and prior to version 0.3.10, locks of the type @nonreentrant"" or @nonreentrant'' do not produce reentrancy checks at runtime. This issue is fixed in version 0.3.10. As a workaround, ensure...
Vyper has incorrect re-entrancy lock when key is empty string
Impact Locks of the type @nonreentrant"" or @nonreentrant'' do not produce reentrancy checks at runtime. Vyper @nonreentrant"" unprotected @external def bar: pass @nonreentrant"lock" protected @external def foo: pass Patches Patched in 3605 Workarounds The lock name should be a non-empty string...
GHSA-3HG2-R75X-G69M Vyper has incorrect re-entrancy lock when key is empty string
Impact Locks of the type @nonreentrant"" or @nonreentrant'' do not produce reentrancy checks at runtime. Vyper @nonreentrant"" unprotected @external def bar: pass @nonreentrant"lock" protected @external def foo: pass Patches Patched in 3605 Workarounds The lock name should be a non-empty string...
mruby:mruby_fuzzer: Nested bug in the same thread, aborting. with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=6172505892847616 Project: mruby Fuzzing Engine: libFuzzer Fuzz Target: mrubyfuzzer Job Type: libfuzzermsanmruby Platform Id: linux Crash Type: Nested bug in the same thread, aborting. Crash Address: Crash State: NULL Sanitizer: memory MSAN Crash...
Incorrect Handling of Empty rights Parameter in delegateAll Function
Lines of code Vulnerability details Description The delegateAll function does not correctly handle the case where the rights parameter is empty. In this case, the function will attempt to write an empty string to the Storage.POSITIONSRIGHTS storage location. This behavior could lead to unexpected...
BELL-CVE-2023-22043 CVE-2023-22043 does not affect BellSoft software
Bulletin has no description...
Oracle Linux 8 : dovecot (ELSA-2019-3467)
The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3467 advisory. - fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes...
llvm:clang-fuzzer: Nested bug in the same thread, aborting. with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=6177449816489984 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: clang-fuzzer Job Type: libfuzzermsanllvm Platform Id: linux Crash Type: Nested bug in the same thread, aborting. Crash Address: Crash State: NULL Sanitizer: memory MSAN Crash...
OESA-2023-1574 file security update
The program checks to see if the file is empty,or if its some sort of special file. Security Fixes: File before 5.43 has an stack-based buffer over-read in filecopystr in funcs.c. NOTE: "File" is the name of an Open Source project.CVE-2022-48554...
BELL-CVE-2022-1304 CVE-2022-1304 does not affect BellSoft software
Bulletin has no description...
BELL-CVE-2016-7923 CVE-2016-7923 does not affect BellSoft software
Bulletin has no description...