11253 matches found
CVE-2023-47639 API Platform Core can leak exceptions message that may contain sensitive information
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. From 3.2.0 until 3.2.4, exception messages, that are not HTTP exceptions, are visible in the JSON error response. This vulnerability is fixed in 3.2.5...
GHSA-RFW5-CQJJ-7V9R API Platform Core can leak exceptions message that may contain sensitive information
Summary Exception messages, that are not HTTP exceptions, are visible in the JSON error response. Details While we wanted to make our errors compatible with the JSON Problem specification, we ended up handling more exceptions then we did previously introduced at...
OESA-2025-1368 transfig security update
The transfig utility creates a makefile which translates FIG created by xfig or PIC figures into a specified LaTeX graphics language for example, PostScriptTM. Transfig is used to create TeX documents which are portable i.e., they can be printed in a wide variety of environments. Security Fixes:...
OESA-2025-1367 transfig security update
The transfig utility creates a makefile which translates FIG created by xfig or PIC figures into a specified LaTeX graphics language for example, PostScriptTM. Transfig is used to create TeX documents which are portable i.e., they can be printed in a wide variety of environments. Security Fixes:...
OSV-2025-253 Security exception in org.apache.lucene.analysis.ckb.SoraniNormalizer.normalize
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=407477665 Crash type: Security exception Crash state: org.apache.lucene.analysis.ckb.SoraniNormalizer.normalize org.apache.lucene.analysis.ckb.SoraniNormalizationFilter.incrementToken...
Sensitive Information Exposure
org.apache.commons, commons-vfs2 is vulnerable to Sensitive Information Exposure. The vulnerability is due to improper handling of exception messages, where the FtpFileObject class exposes the original URI, including sensitive information like passwords, when a file is not found. It allows an...
PT-2025-27562
Name of the Vulnerable Software and Affected Versions Apache Lucene affected versions not specified Description The software experiences a security exception during normalization processes. Specifically, the issue occurs within the SoraniNormalizer.normalize function, which is called during the...
API Platform Core security vulnerabilities
API Platform Core is a server component of API Platform open source by API Platform. A security vulnerability exists in API Platform Core version 3.2.0 that stems from a non-HTTP exception message being visible in a JSON error response...
PyTorch Denial of Service Vulnerability (CNVD-2025-23355)
PyTorch is a Python package open-sourced by PyTorch. PyTorch suffers from a denial of service vulnerability caused by a floating point exception in the function torch.mkldnnmaxpool2d. An attacker can exploit this vulnerability to cause a denial of service...
CVE-2023-47639: Generation of Error Message Containing Sensitive Information
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. From 3.2.0 until 3.2.4, exception messages, that are not HTTP exceptions, are visible in the JSON error response. This vulnerability is fixed in 3.2.5...
Linux kernel IOMMU Buffer Overflow DoS
The vulnerability of the iommureportdevicefault function in the Linux kernel’s IOMMU support driver is related to deficiencies in exception handling. Exploiting this vulnerability can allow an attacker to cause a service failure...
canonical/get-workflow-version-action can leak a partial GITHUB_TOKEN in exception output
Impact Users using the github-token input are impacted. If the get-workflow-version-action step fails, the exception output may include the GITHUBTOKEN. If the full token is included in the exception output, GitHub will automatically redact the secret from the GitHub Actions logs. However, the...
GHSA-26WH-CC3R-W6PJ canonical/get-workflow-version-action can leak a partial GITHUB_TOKEN in exception output
Impact Users using the github-token input are impacted. If the get-workflow-version-action step fails, the exception output may include the GITHUBTOKEN. If the full token is included in the exception output, GitHub will automatically redact the secret from the GitHub Actions logs. However, the...
CVE-2025-31479 canonical/get-workflow-version-action can leak a partial GITHUB_TOKEN in exception output
canonical/get-workflow-version-action is a GitHub composite action to get commit SHA that GitHub Actions reusable workflow was called with. Prior to 1.0.1, if the get-workflow-version-action step fails, the exception output may include the GITHUBTOKEN. If the full token is included in the excepti...
javaparser:parseFuzzer: Security exception in java.base/java.util.Optional.ifPresent
Detailed Report: https://oss-fuzz.com/testcase?key=5306380758351872 Project: javaparser Fuzzing Engine: libFuzzer Fuzz Target: parseFuzzer Job Type: libfuzzerasanjavaparser Platform Id: linux Crash Type: Security exception Crash Address: Crash State: java.base/java.util.Optional.ifPresent...
javaparser:parseFuzzer: Security exception in com.github.javaparser.GeneratedJavaParser.Expression
Detailed Report: https://oss-fuzz.com/testcase?key=4956486952615936 Project: javaparser Fuzzing Engine: libFuzzer Fuzz Target: parseFuzzer Job Type: libfuzzerasanjavaparser Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...
Btrfs Heap Buffer Overflow DoS
The vulnerability of the btrfscowblock function in the Btrfs file system of Linux operating systems is related to insufficient checking of exception states. Exploiting this vulnerability could allow an attacker to cause a service failure...
checkstyle:CheckstyleFuzzer: Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.statement
Project: https://github.com/checkstyle/checkstyle.git Detailed Report: https://oss-fuzz.com/testcase?key=6666727159300096 Project: checkstyle Fuzzing Engine: libFuzzer Fuzz Target: CheckstyleFuzzer Job Type: libfuzzerasancheckstyle Platform Id: linux Crash Type: Security exception Crash Address:...
lucene:QueryParserFuzzer: Security exception in org.apache.lucene.analysis.ckb.SoraniNormalizer.normalize
Detailed Report: https://oss-fuzz.com/testcase?key=6638724308074496 Project: lucene Fuzzing Engine: libFuzzer Fuzz Target: QueryParserFuzzer Job Type: libfuzzerasanlucene Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...
jackson-databind:ObjectReaderRandomClassFuzzer: Security exception in com.github.javaparser.ast.validator.TreeVisitorValidator.accept
Project: https://github.com/FasterXML/jackson-databind.git Detailed Report: https://oss-fuzz.com/testcase?key=6257359324512256 Project: jackson-databind Fuzzing Engine: libFuzzer Fuzz Target: ObjectReaderRandomClassFuzzer Job Type: libfuzzerasanjackson-databind Platform Id: linux Crash Type:...