GHSA-53RV-HCVM-RPP9 Lodestar snappy decompression issue

Impact Unintended permanent chain split affecting greater than or equal to 25% of the network, requiring hard fork network partition requiring hard fork Description Lodestar client may fail to decode snappy framing compressed messages. Vulnerability Details In Req/Resp protocol the message are...

AZL-55670 CVE-2024-53263 affecting package git-lfs for versions less than 3.6.1-1

Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential1 command without checking for embedded line-ending control characters, and then sends any credentials it receives back fr...

AZL-55644 CVE-2024-53263 affecting package git-lfs for versions less than 3.5.1-4

Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential1 command without checking for embedded line-ending control characters, and then sends any credentials it receives back fr...

BIT-PHP-MIN-2020-7065 mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full

In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mbstrtolower function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution...

Cross-site Scripting (XSS)

Overview org.jboss.hal:hal-core is a Core HAL API. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper neutralization of user-controllable input before it is placed in output that is served as a web page. An attacker can execute arbitrary script in the...

CVE-2024-52006: Improper Encoding or Escaping of Output

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems mos...

CVE-2024-50349: Improper Encoding or Escaping of Output

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt i.e. without using any credential helper, it prints out the host name for whic...

PT-2025-5639

Name of the Vulnerable Software and Affected Versions: Lodestar affected versions not specified Description: The issue affects the Lodestar implementation of the ssz snappy encoding protocol, where the checksum in snappy framing uncompressed chunks is not verified. This can lead to unintended...

SwiftASN1 security vulnerabilities

SwiftASN1 is an open source ASN.1 implementation of Swift by Apple. A security vulnerability exists in SwiftASN1 versions prior to 1.3.0 that stems from incorrect assumptions about the form of an object when parsing certain BER/DER constructs, which triggers a precondition failure when these...

EulerOS 2.0 SP10 : openssl (EulerOS-SA-2025-1026)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds...

CVE-2024-12877 GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via deserialization of untrusted input from the donation form like 'firstName'. This makes it possible for unauthenticated attackers to...

CVE-2024-12877 GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via deserialization of untrusted input from the donation form like 'firstName'. This makes it possible for unauthenticated attackers to...

encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion

A flaw was found in the encoding/gob package of the Golang standard library. Calling Decoder.Decoding, a message that contains deeply nested structures, can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635...

CVE-2023-28362: Improper Encoding or Escaping of Output

The redirectto method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header...

FFmpeg security vulnerabilities

FFmpeg is a complete solution for recording, converting, and streaming audio and video from the FFmpeg team. A security vulnerability exists in FFmpeg that originates from an insecure file extension check that can be bypassed to trigger an arbitrary demultiplexer by appending a base64-encoded dat...

Mozilla Firefox Private Browsing Mode

The vulnerability of Mozilla Firefox’s Private Browsing Mode and Thunderbird’s email client on Android operating systems is related to incorrect encoding during the generation of output data. Exploiting this vulnerability can allow remote attackers to enhance their privileges and gain unauthorize...

PT-2025-42738

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.24.9-alt1 OpenTofu versions =2.10.0 Description The issue is a memory exhaustion flaw in the encoding/asn1 package of the Go programming language. The code pre-allocates memory based on fields within a DER structure befo...

graphql-java:GraphqlFuzzer: Security exception in java.base/java.nio.ByteBuffer.wrap

Detailed Report: https://oss-fuzz.com/testcase?key=6237409125138432 Project: graphql-java Fuzzing Engine: libFuzzer Fuzz Target: GraphqlFuzzer Job Type: libfuzzerasangraphql-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: java.base/java.nio.ByteBuffer.wrap...

SAP Business Warehouse XSS

The vulnerability of the SAP Business Warehouse data management and analytics system is related to insufficient encoding of user input data. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks XSS remotely...

Improper Encoding or Escaping of Output

Overview koji is a system for building and tracking RPMS. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output due to improper user input sanitization. Remediation Upgrade koji to version 1.33.2, 1.34.3, 1.35.1 or higher. References - Koji Commit - Koji Issu...