GHSA-F4G4-CJ8F-3CR9 OpenStack Nova logs sensitive context from notification exceptions

An issue was discovered in exceptionwrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens...

EUVD-2016-8331

Zend/zendexceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service infinite loop via a crafted Exception object in serialized data, a related issue to CVE-2015-8876...

GHSA-H2FP-XGX6-XH6F Pallets Werkzeug cross-site scripting vulnerability

Cross-site scripting XSS vulnerability in the renderfull function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 as used in Pallets Flask and other products allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message...

GHSA-4749-P7RX-8JJJ tlslite remote denial of service vulnerability

The tlslite library before 0.4.9 for Python allows remote attackers to trigger a denial of service runtime exception and process crash...

tlslite remote denial of service vulnerability

The tlslite library before 0.4.9 for Python allows remote attackers to trigger a denial of service runtime exception and process crash...

GHSA-GJQ3-997P-HG6F OpenDaylight NULL Pointer Dereference

StreamCorruptedException and NullPointerException in OpenDaylight odl-mdsal-xsql. Controller launches exceptions in the console. Component: OpenDaylight odl-mdsal-xsql is vulnerable to this flaw. Version: The tested versions are OpenDaylight 3.3 and 4.0...

GHSA-XR24-JP5C-6C4V Moodle reveals absolute path in exception message

lib/setuplib.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the absolute path in an exception message...

GHSA-F66H-6MJ2-RWJ2 Moodle multiple cross-site scripting (XSS) vulnerabilities

Multiple cross-site scripting XSS vulnerabilities in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via vectors that trigger an AJAX exception dialog...

Moodle multiple cross-site scripting (XSS) vulnerabilities

Multiple cross-site scripting XSS vulnerabilities in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via vectors that trigger an AJAX exception dialog...

XMLTooling Library Incorrectly Handles Some Exceptions

The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected...

GHSA-6HVF-XVWM-VRW4 XMLTooling Library Incorrectly Handles Some Exceptions

The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected...

libsixel img2sixel Denial of Service Vulnerability

libsixel is a package that provides encoding/decoding implementations for DEC SIXEL graphics and other converter programs. libsixel img2sixel version 1.8.6 suffers from a denial of service vulnerability stemming from a floating-point exception error in ssixelencoderdoresize, encoder.c:633. A remo...

CVE-2021-0190

CVE-2021-0190 is an Intel BIOS/BIOS-authenticated-code vulnerability: uncaught exceptions in BIOS firmware may allow a locally privileged user to escalate privileges. Public sources in the connected documents identify this as a local-privilege-escalation issue affecting Intel CPUs, with several v...

CVE-2021-26364

Insufficient bounds checking in an SMU mailbox register could allow an attacker to potentially read outside of the SRAM address range which could result in an exception handling leading to a potential denial of service...

CVE-2022-29978

There is a floating point exception error in sixelencoderdoresize, encoder.c:633 in libsixel img2sixel 1.8.6. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted JPEG file...

Design/Logic Flaw

There is a floating point exception error in sixelencoderdoresize, encoder.c:633 in libsixel img2sixel 1.8.6. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted JPEG file...

CVE-2022-29978

There is a floating point exception error in sixelencoderdoresize, encoder.c:633 in libsixel img2sixel 1.8.6. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted JPEG file...

CVE-2022-29978

There is a floating point exception error in sixelencoderdoresize, encoder.c:633 in libsixel img2sixel 1.8.6. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted JPEG file...

libsixel 安全漏洞

libsixel is a package that provides encoding/decoding implementations for DEC SIXEL graphics and other converter programs. libsixel img2sixel version 1.8.6 suffers from a denial of service vulnerability stemming from a floating-point exception error in ssixelencoderdoresize, encoder.c:633. A remo...

Microsoft CMD.EXE Integer Overflow

Hi @ll, the subject says it all: a 25 year old TRIVIAL signed integer arithmetic bug which may well have earned a PhD now crashes Windows' command interpreter CMD.exe via its builtin SET command. See their documentation: Classification CWE-190: Integer Overflow or Wraparound CWE-248: Uncaught...