6405 matches found
SUSE CVE-2023-6868
In some instances, the user-agent would allow push requests which lacked a valid VAPID even though the push manager subscription defined one. This could allow empty messages to be sent from unauthorized parties. This bug only affects Firefox on Android. This vulnerability affects Firefox 121...
CVE-2023-50928
"Sandbox Accounts for Events" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event...
cri-o:fuzz_generate_passwd: Crash with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=6441274122829824 Project: cri-o Fuzzing Engine: libFuzzer Fuzz Target: fuzzgeneratepasswd Job Type: libfuzzerasancri-o Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x0000000ff4df Crash State: NULL Sanitizer: address ASAN Recommende...
Amazon Sandbox Accounts for Events Access Control Error Vulnerability
Amazon Sandbox Accounts for Events is an application from Amazon.com, Inc. It allows multiple temporary AWS accounts to be provisioned to multiple authenticated users at the same time through a browser-based GUI. An access control error vulnerability exists in Amazon Sandbox Accounts for Events...
apache-commons-lang:LocaleUtilsFuzzer: Security exception with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=5393416389001216 Project: apache-commons-lang Fuzzing Engine: libFuzzer Fuzz Target: LocaleUtilsFuzzer Job Type: libfuzzerasanapache-commons-lang Platform Id: linux Crash Type: Security exception Crash Address: Crash State: NULL Sanitizer: addres...
CVE-2023-6868
In some instances, the user-agent would allow push requests which lacked a valid VAPID even though the push manager subscription defined one. This could allow empty messages to be sent from unauthorized parties. This bug only affects Firefox on Android. This vulnerability affects Firefox 121...
CVE-2023-6868
In some instances, the user-agent would allow push requests which lacked a valid VAPID even though the push manager subscription defined one. This could allow empty messages to be sent from unauthorized parties. This bug only affects Firefox on Android. This vulnerability affects Firefox 121...
CVE-2023-6868
In some instances, the user-agent would allow push requests which lacked a valid VAPID even though the push manager subscription defined one. This could allow empty messages to be sent from unauthorized parties. This bug only affects Firefox on Android. This vulnerability affects Firefox 121...
Design/Logic Flaw
In some instances, the user-agent would allow push requests which lacked a valid VAPID even though the push manager subscription defined one. This could allow empty messages to be sent from unauthorized parties. This bug only affects Firefox on Android. This vulnerability affects Firefox 121...
UBUNTU-CVE-2023-6868
In some instances, the user-agent would allow push requests which lacked a valid VAPID even though the push manager subscription defined one. This could allow empty messages to be sent from unauthorized parties. This bug only affects Firefox on Android. This vulnerability affects Firefox 121...
CVE-2023-6868
In some instances, the user-agent would allow push requests which lacked a valid VAPID even though the push manager subscription defined one. This could allow empty messages to be sent from unauthorized parties. This bug only affects Firefox on Android. This vulnerability affects Firefox 121...
leptonica:paintcmap_fuzzer: Crash with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=5178944412057600 Project: leptonica Fuzzing Engine: libFuzzer Fuzz Target: paintcmapfuzzer Job Type: libfuzzerasanleptonica Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7ffc12ee1b94 Crash State: NULL Sanitizer: address ASAN...
grok:grk_decompress_fuzzer: Use-of-uninitialized-value with empty stacktrace
Project: https://github.com/GrokImageCompression/grok.git https://github.com/GrokImageCompression/grok-test-data.git Detailed Report: https://oss-fuzz.com/testcase?key=6517019645968384 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzermsangrok Platform Id...
jq:jq_fuzz_fixed: Crash with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=4785110121316352 Project: jq Fuzzing Engine: libFuzzer Fuzz Target: jqfuzzfixed Job Type: libfuzzerubsanjq Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000060281 Crash State: NULL Sanitizer: undefined UBSAN Recommended Security...
SUSE CVE-2023-6507
An issue was found in CPython 3.12.0 subprocess module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the extragroups= parameter with an empty list as a value ie extragroups= the logic regressed to not call setgroups0, NULL before...
GHSA-5MMW-P5QV-W3X5 Always incorrect control flow in github.com/mojocn/base64Captcha
When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct...
Mattermost resource management error vulnerability
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a denial-of-service vulnerability that stems from an inability to handle empty request bodies in an add endpoint, which could be exploited by an attacker to send a request with ...
UBUNTU-CVE-2023-6507
An issue was found in CPython 3.12.0 subprocess module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the extragroups= parameter with an empty list as a value ie extragroups= the logic regressed to not call setgroups0, NULL before...
PSF-2023-12 Groups not dropped before running subprocess when using empty 'extra_groups' parameter
An issue was found in CPython 3.12.0 subprocess module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the extragroups= parameter with an empty list as a value ie extragroups= the logic regressed to not call setgroups0, NULL before...
Candid infinite decoding loop through specially crafted payload
Impact The Candid library causes a Denial of Service while parsing a specially crafted payload with empty data type. For example, if the payload is record ; empty and the canister interface expects record then the rust candid decoder treats empty as an extra field required by the type. The proble...