CVE-2023-35890

CVE-2023-35890 affects IBM WebSphere Application Server 8.5 and 9.0. the issue is weaker-than-expected security caused by improper encoding in a local configuration file. IBM advisories link to fixes/upgrades; remediation varies by product: ITNCM (IBM Tivoli Netcool Configuration Manager) 6.4.2: ...

CVE-2023-35890 IBM WebSphere Application Server information disclosure

IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security, caused by the improper encoding in a local configuration file. IBM X-Force ID: 258637...

PT-2023-25365 · Ibm · Ibm Websphere Application Server

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Application Server versions 8.5 through 9.0 Description: The issue is caused by improper encoding in a local configuration file, which could provide weaker than expected security. Recommendations: For IBM WebSphere Application...

IBM WebSphere Application Server 8.5.5.23 < 8.5.5.24 / 9.0.5.15 < 9.0.5.17 (7007857)

The IBM WebSphere Application Server running on the remote host is affected by a improper encoding flaw. IBM WebSphere Application Server 8.5 and 9.0 traditional could provide weaker than expected security, caused by the improper encoding in a local configuration file. Note that Nessus has not...

golang: encoding/pem: fix stack overflow in Decode

A buffer overflow flaw was found in Golang's library encoding/pem. This flaw allows an attacker to use a large PEM input more than 5 MB, causing a stack overflow in Decode, which leads to a loss of availability...

ROS-2-555

2.555 Multiple vulnerabilities in libwebp 1. Vulnerability description: CVE-2020-36332 A vulnerability in the libwebp library for encoding and decoding WebP images, is related to improper control of internal resource consumption. Exploitation of the vulnerability could allow an attacker acting...

gRPC connection termination issue

gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for -bin suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyo...

ROS-2-533

2.533 Multiple vulnerabilities in libwebp 1. Vulnerability description: CVE-2020-36332 A vulnerability in the libwebp library for encoding and decoding WebP images, is related to improper control of internal resource consumption. Exploitation of the vulnerability could allow an attacker acting...

ROS-2-1481

2.1481 Multiple vulnerabilities in libwebp 1. Vulnerability Description: CVE-2020-36332 A vulnerability in the libwebp library for encoding and decoding WebP images, is related to improper control of internal resource consumption. Exploitation of the vulnerability could allow an attacker acting...

Format string

Pandoc is a Haskell library for converting from one markup format to another, and a command-line tool that uses this library. Starting in version 1.13 and prior to version 3.1.4, Pandoc is susceptible to an arbitrary file write vulnerability, which can be triggered by providing a specially crafte...

PT-2023-24695 · Apache · Apache Any23

Name of the Vulnerable Software and Affected Versions: Apache Any23 affected versions not specified Description: The use of TikaEncodingDetector in Apache Any23 can cause excessive memory usage. Recommendations: At the moment, there is no information about a newer version that contains a fix for...

Fedora: Security Advisory for golang-github-schollz-mnemonicode (FEDORA-2023-ac4651c9b2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 38 Update: golang-github-schollz-mnemonicode-1.0.1-6.20230519git63fa713.fc38

Mnemonicode is a method for encoding binary data into a sequence of words whi ch can be spoken over the phone, for example, and converted back to data on the other side...

编号撤回

OBS Studio is an OBS Project open source software designed for efficiently capturing, compositing, encoding, recording and streaming video content. This CVE number has been withdrawn...

IBM WebSphere Application Server 加密问题漏洞

IBM WebSphere Application Server WAS is an application server product from International Business Machines IBM. The product is a platform for JavaEE and Web services applications and is the foundation of the IBM WebSphere software platform. A security vulnerability exists in IBM WebSphere...

LibTIFF 安全漏洞

LibTIFF is a library for reading and writing TIFF Tagged Image File Format files. The library contains some command line tools for working with TIFF files. A security vulnerability exists in LibTIFF version 4.5.0, which stems from a buffer overflow vulnerability in the uvencode function...

keycloak: path traversal via double URL encoding

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. Thi...

Stored XSS

Description: The application contains a stored XSS vulnerability, which allows an attacker to inject and execute malicious scripts within the application. The vulnerability occurs due to improper input validation and output encoding mechanisms, which fail to adequately sanitize and encode...

CVE-2023-28800 Output encoding missing in redrurl parameter

When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login...

CVE-2023-28800 Output encoding missing in redrurl parameter

When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login...