Information Disclosure

yaql is vulnerable to Information Disclosure. The vulnerability is due to improper handling of attribute access in the YAQL library's 'format' function, allowing unauthorized users to access sensitive information, including service account credentials...

jose-go: improper handling of highly compressed data

A vulnerability was found in Jose due to improper handling of highly compressed data. This issue could allow an attacker to send a JWE containing compressed data that uses large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti...

jose-go: improper handling of highly compressed data

A vulnerability was found in Jose due to improper handling of highly compressed data. This issue could allow an attacker to send a JWE containing compressed data that uses large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti...

Open Automation Software OAS Platform OAS Engine File Data Source Configuration denial of service vulnerability

Talos Vulnerability Report TALOS-2024-1948 Open Automation Software OAS Platform OAS Engine File Data Source Configuration denial of service vulnerability April 3, 2024 CVE Number CVE-2024-24976 SUMMARY A denial of service vulnerability exists in the OAS Engine File Data Source Configuration...

Amazon Linux 2023 : squid (ALAS2023-2024-578)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-578 advisory. Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing...

SVG Injection

piccoloadmin is vulnerable to SVG Injection. This vulnerability due to insufficient input validation and improper handling of SVG files within Piccolo's admin panel, allowing attackers to upload a malicious SVG file, which, when loaded under certain contexts, permits arbitrary access to the admin...

Cisco IOS XE Software NETCONF/RESTCONF IPv4 Access Control List Bypass (cisco-sa-dmi-acl-bypass-Xv8FO8Vz)

According to its self-reported version, Cisco IOS-XE Software is affected by a vulnerability. - A vulnerability in the data model interface DMI services of Cisco IOS XE Software could allow an unauthenticated, remote attacker to access resources that should have been protected by a configured IPv...

MGASA-2024-0094 Updated thunderbird packages fix security vulnerabilities

Crash in NSS TLS method. CVE-2024-0743 JIT code failed to save return registers on Armv7-A. CVE-2024-2607 Integer overflow could have led to out of bounds write. CVE-2024-2608 Improve handling of out-of-memory conditions in ICU. CVE-2024-2616 NSS susceptible to timing attack against RSA decryptio...

CVE-2024-20314

A vulnerability in the IPv4 Software-Defined Access SD-Access fabric edge node feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause high CPU utilization and stop all traffic processing, resulting in a denial of service DoS condition on an affected device. This...

jose-go: improper handling of highly compressed data

A vulnerability was found in Jose due to improper handling of highly compressed data. This issue could allow an attacker to send a JWE containing compressed data that uses large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti...

Sensitive Information Disclosure

Liferay Portal is vulnerable to Sensitive Information Disclosure. This vulnerability is due to improper handling of hashed passwords within the page source...

Cross Site Scripting(XSS)

survey-creator is vulnerable to Cross Site Scripting XSS. This vulnerability is due to improper handling of the title parameter in form within string-editor.ts. This flows allows an attackers to execute arbitrary code and obtain sensitive information...

Return-Oriented Programming(ROP)

thunderbird:sid, firefox-esr:sid is vulnerable to Return-Oriented ProgrammingROP. The vulnerability is due to improper handling of return registers, potentially allowing attackers to execute arbitrary code by overwriting them with controlled values...

Out-of-Bounds Write

Apache Commons Configuration is vulnerable to Out-of-Bounds Write. The vulnerability is due to improper handling of a cyclical object tree, which can trigger a StackOverflowError when the ListDelimiterHandler.flatten method is called. This occurs because the method recursively traverses the objec...

Mozilla Firefox Security Bypass Vulnerability (CNVD-2024-14982)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security bypass vulnerability exists in Mozilla Firefox that stems from improper handling of WASM register values. An attacker can exploit the vulnerability to create invalid wasm values...

Open Redirect

Liferay Portal is vulnerable to Open Redirect. The vulnerability is due to improper handling of the 'REPLACEMENT CHARACTER' U+FFFD in HtmlUtil.escapeRedirect, allowing remote attackers to redirect users to arbitrary external URLs...

Insertion Of Sensitive Information Into Log File

Kibana is vulnerable to Insertion of Sensitive Information into Log File. The vulnerability is caused due to improper handling of errors or debug logging, leading to the inclusion of credentials, API keys, and other sensitive data in Kibana logs. This potentially leads to Sensitive Information...

Apache Answer Competitive Conditions Issue Vulnerability

Apache Answer is a community platform of the Apache USA Foundation. Apache Answer 1.2.1 and prior versions suffer from a Competing Conditions vulnerability, which arises from improper handling of concurrent access when concurrent code requires mutually exclusive access to shared resources during...

Cross site scripting

JFrog Artifactory versions below 7.77.7, are vulnerable to DOM-based cross-site scripting due to improper handling of the import override mechanism...

ROS-2-461

2.461 BusyBox Denial of Service CVE-2021-28831 1. Vulnerability Description: The vulnerability allows a remote attacker to perform a denial of service DoS attack. The vulnerability exists due to improper handling of the error bit in the huftbuild result pointer in the decopressgunzip.c file. A...