436 matches found
CVE-2023-39914 BER/CER/DER decoder panics on invalid input
NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding...
CVE-2023-39914 BER/CER/DER decoder panics on invalid input
NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding...
BER/CER/DER decoder panics on invalid input
Due to insufficient checking of input data, decoding certain data sequences can lead to bcder panicking rather than returning an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding. bcder 0.7.3 fixes these issues by more...
NLnet Labs bcder Security Breach
NLnet Labs bcder is NLnet Labs open source a library . Provides ASN.1 standard Basic Encoding Rules BER and more stringent canonical encoding rules CER and Distinguished Encoding Rules DER variants of decoding and encoding . A security vulnerability exists in NLnet Labs bcder 0.7.2 and earlier...
PT-2023-27149 · Nlnet +1 · Bcder +1
Name of the Vulnerable Software and Affected Versions: NLnet Labs' bcder library versions 0.7.2 and earlier Description: The bcder library panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as...
The vulnerability of the ThinServer component of the Rockwell Automation ThinManager application management platform allows a attacker to trigger a service failure.
The vulnerability of the ThinServer component of Rockwell Automation’s ThinManager application management platform exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...
CRITICAL UPGRADES IN THE DIAMOND PROXY COULD BE MISSED DUE TO INVALID ACTIONS PASSED IN
Lines of code Vulnerability details Impact The LibDiamond.diamondCut function is used to modify the facets by passing in the FacetCut structs. The FacetCut struct contains the action to perform: add, replace and remove and the function selectors to use for them. Here the function implementation...
AZL-27310 CVE-2023-36617 affecting package ruby for versions less than 3.1.4-2
A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396parser.rb and rfc3986parser.rb. NOTE: this issue exists becuse of a...
The _poolId and _id values are not within the expected range and not performing appropriate bounds checking in the VAULTPROXY contract
Lines of code Vulnerability details Impact When the poolId and id values are not within the expected range and appropriate bounds checking is not performed in the contract, it can result in high risk and vulnerabilities. Here are some potential risks and vulnerabilities that can arise: 1. Invalid...
Uncaught exception in document parsing functions
Description The parseDocument and parseAllDocuments functions should never throw according to the documentation. However, when these functions are fed an invalid input with a lot ≥80 of carriage return characters \r, an exception is thrown, which originates in the prettifyError function. Proof of...
jetty-http: improver hostname input handling
A flaw was found in Eclipse Jetty. When parsing the authority segment of an HTTP scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This issue can lead to failures in a Proxy scenario...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS due to a malicious invalid input with zero dimension, which crashes a TensorFlow model Check Failed. Note: An attacker must have privilege to provide input to a Convolution3DTranspose call. PoC import tensorflow as...
A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.
...
CVE-2022-4904
A flaw was found in the c-ares package. The aressetsortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity...
The vulnerability of the application software interface for Active Directory Domain Services on the Windows operating system allows a perpetrator to cause a service failure.
The vulnerability of the Active Directory Domain Services application programming interface for the Windows operating system exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...
DEBIAN-CVE-2023-20938
In bindertransactionbufferrelease of binder.c, there is a possible use after free due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android...
DEBIAN-CVE-2023-23108
In crasm 1.8-3, invalid input validation, specific files passed to the command line application, can lead to a NULL pointer dereference in the function Xasc...
Null pointer dereference
In crasm 1.8-3, invalid input validation, specific files passed to the command line application, can lead to a NULL pointer dereference in the function Xasc...
