Deserialization of Untrusted Data

Overview picklescan is a Security scanner detecting Python Pickle files performing suspicious actions Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the STACKGLOBAL opcode parsing process. An attacker can bypass detection mechanisms by crafting a malicio...

PT-2026-50455

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.27 modelscan affected versions not specified Description A parsing logic error exists in the list globals function when processing STACK GLOBAL opcodes. The scanner fails to track arguments in the correct range...

PT-2025-34324 · Pypi · Picklescan

Details There's a parsing logic error in picklescan and modelscan while trying to deal with opcode STACK GLOBAL. Function list globals when handling STACK GLOBAL at position n, it is expected to track two arguments but in wrong range. The loop only consider the range from 1 to n-1 but forgets to...

BIT-LIBPHP-2023-3823 Security issue with external entity loading in XML without enabling it

In PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling...

BIT-LIBPHP-2020-7060 global buffer-overflow in mbfl_filt_conv_big5_wchar

When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbflfiltconvbig5wchar to read past the allocated buffer. This may lead to information disclosur...

BIT-LIBPYTHON-2024-4032 Incorrect IPv4 and IPv6 private ranges

The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the isprivate and isglobal properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and...

Linux Distros Unpatched Vulnerability : CVE-2024-26730

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: hwmon: nct6775 Fix access to temperature configuration registers The number of temperature...

Linux Distros Unpatched Vulnerability : CVE-2022-49769

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gfs2: Check sbbsizeshift after reading superblock Fuzzers like to scribble over sbbsizeshift but in reality it's very unlikely that this field would be corrupte...

Linux Distros Unpatched Vulnerability : CVE-2021-20288

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHXGETAUTHSESSIONKEY requests, it doesn't sanitize otherkeys,...

PT-2025-33704 · Git · Libdwarf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=437060549 Crash type: Heap-buffer-overflow READ 4 Crash state: dwarf memcpy noswap bytes dwarf length of cu header dwarf global name offsets...

Linux Distros Unpatched Vulnerability : CVE-2023-52526

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: erofs: fix memory leak of LZMA global compressed deduplication When stressing microLZMA EROF...

Linux Distros Unpatched Vulnerability : CVE-2021-46939

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing: Restructure traceclockglobal to never block It was reported that a fix to the ring buffer recursion detection would cause a hung machine when performin...

Linux Distros Unpatched Vulnerability : CVE-2022-49739

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gfs2: Always check inode size of inline inodes Check if the inode size of stuffed inline inodes is within the allowed range when reading inodes from disk...

Update of nss

update to CKBI 2.74 from NSS 3.110 - updated certificates: - Certificate "certSIGN ROOT CA" - Certificate "ACCVRAIZ1" - Certificate "Entrust Root Certification Authority - G4" - Certificate "Security Communication ECC RootCA1" - Certificate "BJCA Global Root CA1" - Certificate "BJCA Global Root...

Linux Distros Unpatched Vulnerability : CVE-2021-47587

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: net: systemport: Add global locking for descriptor lifecycle The descriptor list is a shared...

Linux Distros Unpatched Vulnerability : CVE-2024-46688

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: erofs: fix out-of-bound access when zerofsgbufgrowsize partially fails If zerofsgbufgrowsize...

Sensitive Information Disclosure

Opencast is vulnerable to Sensitive Information Disclosure. The vulnerability is due to exposure of hashed credentials due to incorrect handling of global system account credentials when fetching mediapackage elements, allowing attackers with ingest permissions to exfiltrate them to an external U...

WordPress Global Gallery Plugin <= 9.2.3 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Anhchangmutrang in WordPress Plugin Global Gallery versions = 9.2.3...

Linux Distros Unpatched Vulnerability : CVE-2023-53057

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HCI: Fix global-out-of- bounds To loop a variable-length array,...

Linux Distros Unpatched Vulnerability : CVE-2024-26608

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix global oob in ksmbdnlpolicy Similar to a reported issue check the commit...