ROS-2-1188

2.1188 BusyBox Denial of Service CVE-2021-28831 1. Vulnerability Description: The vulnerability allows a remote attacker to perform a denial of service DoS attack. The vulnerability exists due to improper handling of the error bit in the huftbuild result pointer in the decopressgunzip.c file. A...

CVE-2024-28180

A vulnerability was found in Jose due to improper handling of highly compressed data. This issue could allow an attacker to send a JWE containing compressed data that uses large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Mitigation Mitigation for this issue is either...

CVE-2024-28180 Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...

CVE-2024-28180 Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...

Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

Impact An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size whichever is larger. Thanks to Enze...

Input validation

Improper Handling of Insufficient Privileges in Samsung Account prior to version 14.8.00.3 allows local attackers to access data...

CVE-2024-20837

Improper handling of granting permission for Trusted Web Activities in Samsung Internet prior to version 24.0.0.41 allows local attackers to grant permission to their own TWA WebApps without user interaction...

HTML Injection

docassemblewebapp is vulnerable to HTML injection. The vulnerability is due to improper handling of user-added HTML including user's name field, allowing the input to be displayed on the screen as HTML which can also include...

Denial Of Service (DoS)

Rack is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of Range headers, allowing an attacker to craft headers in a way that results in an unexpectedly large response, which can result in Denial of Service DoS...

Path Traversal (Zip Slip)

github.com/artdarek/go-unzip is vulnerable to Zip Slip. The vulnerability is due to improper handling of file paths within an archive. An attacker can construct an archive containing files with arbitrary paths which results in arbitrary file write outside of the restricted target directory during...

Denial Of Service (DoS)

drupal/core is vulnerable to Denial Of Service DoS. The vulnerability is due to improper handing of requests within the comment module, allowing an attacker reply requests resulting in DoS...

CVE-2024-25445

Improper handling of values in HuginBase::PTools::Transform::transform of Hugin 2022.0.0 leads to an assertion failure...

CVE-2024-25445

Improper handling of values in HuginBase::PTools::Transform::transform of Hugin 2022.0.0 leads to an assertion failure...

Hugin security breach

Hugin is a cross-platform open source panoramic photography image stitching software by Hugin Open Source. A security vulnerability exists in Hugin version v2022.0.0, which stems from an assertion failure due to improper handling of values...

CVE-2024-25445

CVE-2024-25445 affects Hugin 2022.0.0 where HuginBase::PTools::Transform::transform mishandles input values, triggering an assertion failure (crash). This is listed with high impact (Confidentiality/Integrity/Availability High) and local exploitability with user interaction required. OpenSUSE/Fed...

CVE-2024-25445

Improper handling of values in HuginBase::PTools::Transform::transform of Hugin 2022.0.0 leads to an assertion failure...

Cross-Site Scripting (XSS)

dash-core-components are vulnerable to Cross Site Scripting XSS. The vulnerability is caused due to improper handling of the href attribute of the tag when the href attribute is controlled by an adversary. This allows an attacker to steal data that is visible to another user who opens a view...

CVE-2020-36773

Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c for txtwrite because a single character code in a PDF document can map to more than one Unicode code point e.g., for a ligature...

Cross Site Scripting (XSS)

@tanstack/react-query-next-experimental is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper handling of the id variable within the createHydrationStreamProvider method, which allows an attacker to inject arbitrary JavaScript when react-query-next-experimental preforms...

Heap-based Buffer Overflow

GNU coreutils is vulnerable to a heap overflow vulnerability. The vulnerability is due to improper handling of user-controlled data of multiple hundred bytes in length in the linebytessplit function, potentially leading to an application crash and denial of service...