4026 matches found
gstreamer1-plugins-base: stack-buffer overflow in gst_opus_dec_parse_header
A flaw was found in the GStreamer library. A stack buffer overflow in the Opus decoder can cause crashes for certain input files, potentially allowing a malicious third party to trigger an application crash...
CVE-2024-11858
CVE-2024-11858 affects Radare2. Affected: Radare2 up to and including version 5.9.x (per sources noting 5.9.8 and earlier; Nessus/Tenable references RS 5.8.0–5.9.4). The root cause is insufficient input validation when handling Pebble Application files, allowing malicious inputs to inject shell c...
CVE-2024-11759
CVE-2024-11759 (Bukza) is a WordPress plugin vulnerability: the Bukza shortcode in versions up to and including 2.0.0 is affected by a stored cross-site scripting (XSS) due to insufficient input sanitization and output escaping on user-supplied attributes. This allows an authenticated attacker wi...
USN-7153-1: PHP vulnerability
It was discovered that PHP incorrectly handled long string inputs in two database drivers. An attacker could possibly use this issue to write files in locations they would not normally have access to. CVE-2024-11236...
USN-7153-1 php7.0, php7.2 vulnerability
It was discovered that PHP incorrectly handled long string inputs in two database drivers. An attacker could possibly use this issue to write files in locations they would not normally have access to. CVE-2024-11236...
GHSA-GHW8-3XQW-HHCJ Duplicate Advisory: cert-manager ha a potential slowdown / DoS when parsing specially crafted PEM inputs
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r4pg-vg54-wxx4. This link is maintained to preserve external references. Original Description A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the...
CVE-2024-12401 Cert-manager: potential dos when parsing specially crafted pem inputs
A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service DoS vector for the cert-manag...
Incomplete List of Disallowed Inputs
Overview Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs through the manipulation of Twig templates. An attacker can modify or delete data by bypassing the sandbox restrictions designed to limit template capabilities. Note: This is only exploitable if the...
Incomplete List of Disallowed Inputs
Overview Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs through the manipulation of Twig templates. An attacker can modify or delete data by bypassing the sandbox restrictions designed to limit template capabilities. Note: This is only exploitable if the...
league/commonmark's quadratic complexity bugs may lead to a denial of service
Impact Several polynomial time complexity issues in league/commonmark may lead to unbounded resource exhaustion and subsequent denial of service. Malicious users could trigger that inefficient code with carefully crafted Markdown inputs that are specifically designed to ensure the worst-case...
GHSA-MWCW-C2X4-8C55 Predictable results in nanoid generation when given non-integer values
When nanoid is called with a fractional value, there were a number of undesirable effects: 1. in browser and non-secure, the code infinite loops on while size-- 2. in node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled 3. if the...
PT-2024-36557
Name of the Vulnerable Software and Affected Versions nanoid versions prior to 5.0.9 nanoid version 3.3.8 is a fixed version, implying versions prior to 3.3.8 are also affected, but since 3.3.8 is mentioned as a fixed version, it indicates that versions before 3.3.8 and between 3.3.8 and 5.0.9 ar...
CVE-2024-53589
GNU objdump 2.43 is vulnerable to Buffer Overflow in the BFD Binary File Descriptor library's handling of tekhex format files...
The vulnerability of the GENESIS64 SCADA system’s software packages for monitoring and data collection, developed by MC Works64, arises from the use of external control inputs for class selection. This allows a intruder to execute arbitrary code.
The vulnerability of the GENESIS64 SCADA system’s software packages for monitoring and data collection via MC Works64 is related to the use of externally controlled input data for class selection. Exploiting this vulnerability allows a perpetrator to execute arbitrary code...
CVE-2024-53992
CVE-2024-53992 affects unzip-bot, a Telegram bot that extracts archives. The vulnerability arises from unsanitized inputs (archive name, password, or video name) that can be crafted to trigger command execution via subprocess.Popen with shell=True. Documented impact includes potential remote code...
CVE-2024-53992 unzip-bot Allows Remote Code Execution (RCE) via archive extraction, password prompt, or video upload
unzip-bot is a Telegram bot to extract various types of archives. Users could exploit unsanitized inputs to inject malicious commands that are executed through subprocess.Popen with shell=True. Attackers can exploit this vulnerability using a crafted archive name, password, or video name. This...
CVE-2024-53992 unzip-bot Allows Remote Code Execution (RCE) via archive extraction, password prompt, or video upload
unzip-bot is a Telegram bot to extract various types of archives. Users could exploit unsanitized inputs to inject malicious commands that are executed through subprocess.Popen with shell=True. Attackers can exploit this vulnerability using a crafted archive name, password, or video name. This...
PT-2024-36004 · Unzip-Bot · Unzip-Bot
Name of the Vulnerable Software and Affected Versions: unzip-bot versions prior to 7.0.3a Description: The issue allows users to exploit unsanitized inputs to inject malicious commands that are executed through subprocess.Popen with shell=True. Attackers can exploit this using a crafted archive...
Qualcomm Chipsets 安全漏洞
Qualcomm Chipsets are a series of chipsets from Qualcomm, Inc. A security vulnerability exists in Qualcomm Chipsets that stems from a possible memory corruption when processing NPU API calls with invalid inputs if the inputs are not validated...
