Alexandre Dulaunoy ssldump buffer error vulnerability

Alexandre Dulaunoy’s ssldump 1.9.0 and earlier versions contain a buffer error vulnerability. This vulnerability stems from an error in the calculation of the heap buffer allocation size by the fanxfingerprint function in ssl/sslxprint.c when formatting FAN/X.509 certificate fingerprints...

CoAI.Dev path traversal vulnerability

CoAI.Dev 4.0.0 and earlier versions have a path traversal vulnerability. This vulnerability stems from unvalidated path traversal vulnerabilities in the endpoints for generating and archiving articles. Attackers can use hash query parameters to download arbitrary .tar.gz or .zip files, including...

WordPress ELEX – WordPress HelpDesk & Customer Ticketing System: Arbitrary File Upload Vulnerability

WordPress ELEX WordPress HelpDesk & Customer Ticketing System versions 3.3.7 and earlier have an arbitrary file upload vulnerability. This vulnerability stems from the initMailPart function, which does not properly validate the file type when saving IMAP email attachments. This allows unauthorize...

DoubleScale CRM arbitrary file upload vulnerability

DoubleScale CRM versions 1.5.1 and earlier have a vulnerability related to arbitrary file uploads. This vulnerability stems from the storeupload function, which allows for arbitrary file uploads. The extensionisallowed function, which is responsible for checking whether files with unrecognized...

Javahuang SurveyKing Authorization Issue Vulnerability

Javahuang SurveyKing versions prior to 1.13.0 have an authorization issue vulnerability. This vulnerability stems from a lack of authorization verification. Unverified attackers can download any stored file through the GET /api/public/preview/attachmentId interface. They can also bypass the...

Groundhogg path traversal vulnerability

Groundhogg versions 4.9.3 and earlier have a path traversal vulnerability. This vulnerability stems from insufficient file path validation in the copyfile function. As a result, authenticated attackers with access levels of Sales Representative or higher, or those who have the ability to import...

5rahim Seanime command injection vulnerability

The 5rahim Seanime version from 3.7.0 to 3.10.3 has a command injection vulnerability. This vulnerability arises due to improper authorization; unauthenticated LAN or Tailnet clients can bypass the media stream settings. By using the transcodeHwAccelCustomSettings field, they can append...

Astra Linux – Vulnerability in libass

A stack overflow occurred in the parsetag function in libass/assparse.c in libass before version 0.15.0. This vulnerability allows remote attackers to cause a denial of service or remote code execution through a crafted file...

Astra Linux – vulnerability in linux-5.10

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix the behavior of READ near OFFSETMAX Dan Aloni reports: Due to commit 8cfb9015280d “NFS: Always provide aligned buffers to the RPC read layers” on the client, a read of 0xfff is aligned up to server rsize of 0x1000. As a...

Astra Linux – Vulnerability in gdcm

There is an out-of-bounds write vulnerability in the JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to a heap buffer overflow. An attacker can provide a malicious file to exploit this vulnerability...

Astra Linux – Vulnerability in Vim

Vim is an open-source command-line text editor. From version 9.2.0320 to 9.2.0679, a crafted undo or swap file could store a virtual-text property whose offset and length points outside the line’s property data. When Vim restores or displays such a line, it converts the offset into a pointer and...

Astra Linux – vulnerability in Rails

Active Storage enables users to attach cloud and local files to Rails applications. In versions prior to 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage’s DiskServicepathfor fails to validate whether the resolved filesystem path remains within the storage root directory. If a blob key containing pa...

Astra Linux – vulnerability in golang-1.23

The “go tool pack” subcommand usually used only by the compiler as an internal tool with known-good inputs does not sanitize output filenames. Extracting a malicious archive file using the “pack” subcommand can write files to arbitrary locations on the filesystem...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: f2fs: A fix was made to perform a sanity check on the destination blkaddr during recovery. As Wenqing Liu reported in Bugzilla: https://bugzilla.kernel.org/showbug.cgi?id=216456 loop5: A change in capacity was detected, from 0...

Astra Linux – Vulnerability in firejail

A privilege context switching issue was discovered in the join.c file of Firejail 0.9.68. By creating a fake Firejail container that is accepted by the Firejail setuid-root program as a join target, a local attacker can enter an environment where the Linux user namespace remains the initial user...

Astra Linux – Vulnerability in exempi

The XMP Toolkit SDK version 2021.07 and earlier is affected by a stack-based buffer overflow vulnerability that may lead to arbitrary code execution within the context of the current user. Exploitation requires user interaction—that is, the victim must open a specially crafted file...

Astra Linux – Vulnerability in exempi

The XMP Toolkit SDK version 2020.1 and earlier is affected by a buffer overflow vulnerability that may lead to local application denial of service in the context of the current user. Exploitation requires user interaction, as the victim must open a specially crafted file...

Astra Linux – vulnerability in exempi

XMP Toolkit 2021.07 and earlier is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could exploit this vulnerability to cause a denial-of-service condition for the application, specifically targeting the current user...

Astra Linux – vulnerability in linux-5.10

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix iasize underflow iattr::iasize is a lofft, which is a signed 64-bit type. NFSv3 and NFSv4 both define file size as an unsigned 64-bit type. Therefore, there is a range of valid file size values that an NFS client can...

Astra Linux – vulnerability in libtirpc

In libtirpc versions prior to 1.3.3rc1, remote attackers could exhaust the file descriptors of a process using libtirpc, as idle TCP connections were mishandled. This, in turn, could result in an svcrun infinite loop without accepting new connections...