USN-6264-1 webkit2gtk vulnerabilities

Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and...

CVE-2023-3633

An out-of-bounds write vulnerability in Bitdefender Engines on Windows causes the engine to crash. This issue affects Bitdefender Engines version 7.94791 and lower...

CVE-2023-3633

An out-of-bounds write vulnerability in Bitdefender Engines on Windows causes the engine to crash. This issue affects Bitdefender Engines version 7.94791 and lower...

CVE-2023-3633 Out of Bounds Memory Corruption Issue in CEVA Engine

An out-of-bounds write vulnerability in Bitdefender Engines on Windows causes the engine to crash. This issue affects Bitdefender Engines version 7.94791 and lower...

CVE-2023-36834 Junos OS: SRX 4600 and SRX 5000 Series: The receipt of specific genuine packets by SRXes configured for L2 transparency will cause a DoS

An Incomplete Internal State Distinction vulnerability in the packet forwarding engine PFE of Juniper Networks Junos OS on SRX 4600 and SRX 5000 Series allows an adjacent attacker to cause a Denial of Service DoS. If an SRX is configured in L2 transparent mode the receipt of a specific genuine...

Bitdefender Engines 缓冲区错误漏洞

Bitdefender Engines is an antivirus engine from the Romanian company Bitdefender. A buffer error vulnerability exists in Bitdefender Engines version 7.94791 and earlier, which stems from the presence of an out-of-bounds write vulnerability that can cause the engine to crash...

PT-2023-25538 · Bitdefender · Bitdefender Engines

Name of the Vulnerable Software and Affected Versions: Bitdefender Engines versions 7.94791 and lower Description: An out-of-bounds write issue in Bitdefender Engines on Windows causes the engine to crash. Recommendations: For versions 7.94791 and lower, update to a version higher than 7.94791 to...

CVE-2023-30586

A vulnerability has been identified in the Node.js 20, allows loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model...

CVE-2023-30586

A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine API can be used to bypass...

CVE-2023-30586

A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine API can be used to bypass...

fief-server Server-Side Template Injection vulnerability

Server-Side Template Injection Overview of the Vulnerability Server-Side Template Injection SSTI is a vulnerability within application templating engines where user input is improperly handled and is embedded into the template, possibly leading code being executed. An attacker can use SSTI to...

Malvertising via brand impersonation is back again

Web search is about to embark on a new journey thanks to artificial intelligence technology that online giants such as Microsoft and Google are experimenting with. Yet, there is a problem when it comes to malicious ads displayed by search engines that AI likely won't be able to fix. In recent...

Hackers Using Golang Variant of Cobalt Strike to Target Apple macOS Systems

A Golang implementation of Cobalt Strike called Geacon is likely to garner the attention of threat actors looking to target Apple macOS systems. That's according to findings from SentinelOne, which observed an increase in the number of Geacon payloads appearing on VirusTotal in recent months...

kernel: drm/i915: mark requests for GuC virtual engines to avoid use-after-free

A use-after-free vulnerability was found in the Linux kernel Intel i915 graphics driver's GuC virtual engine request handling. A local user with access to GPU rendering can create requests on GuC virtual engines and trap references via syncfile or dmabuf, causing fence release operations to acces...

PT-2025-40694

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the drm/i915 subsystem related to handling requests for GuC virtual engines. Specifically, references to i915 requests could be held indefinitely acro...

Node.js: OpenSSL engines can be used to bypass and/or disable the permission model

Arbitrary OpenSSL engines could be loaded in Node.js 20, even when the permission model was enabled, which could bypass and/or disable the permission model, allowing for arbitrary code execution...

Sql injection

Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to SQL injection in the sql/instance.py endpoint's describe method. In several cases, user...

PT-2023-22782 · Archery · Archery

Name of the Vulnerable Software and Affected Versions: Archery affected versions not specified Description: The Archery project contains multiple SQL injection vulnerabilities, allowing an attacker to query connected databases. The issue arises from the explain method in sql optimize.py, where us...

MAC 1200R Directory Traversal

Exploit Title: MAC 1200R - Directory Traversal Google Dork: "MAC1200R" && port="8888" Date: 2023/03/09 Exploit Author: Chunlei Shang, Jiangsu Public Information Co., Ltd. Vendor Homepage: https://www.mercurycom.com.cn/ Software Link: https://www.mercurycom.com.cn/product-1-1.html Version: all...

MAC 1200R - Directory Traversal

Exploit Title: MAC 1200R - Directory Traversal Google Dork: "MAC1200R" && port="8888" Date: 2023/03/09 Exploit Author: Chunlei Shang, Jiangsu Public Information Co., Ltd. Vendor Homepage: https://www.mercurycom.com.cn/ Software Link: https://www.mercurycom.com.cn/product-1-1.html Version: all...