Design/Logic Flaw

Uncontrolled search path in the IntelR QuartusR Prime Pro edition software before version 22.3 may allow an authenticated user to potentially enable escalation of privilege via local access...

Design/Logic Flaw

Incorrect default permissions for the IntelR HDMI Firmware Update Tool for NUC before version 1.79.1.1 may allow an authenticated user to potentially enable escalation of privilege via local access...

Design/Logic Flaw

Incorrect default permissions for the IntelR NUC Pro Software Suite before version 2.0.0.3 may allow an authenticated user to potentially enable escalation of privilege via local access...

Design/Logic Flaw

Access of memory location after end of buffer in some IntelR Server Board BMC firmware before version 2.90 may allow a privileged user to enable escalation of privilege via local access...

Design/Logic Flaw

Uncontrolled search path in some IntelR oneAPI Toolkit and component software installers before version 4.3.0.251 may allow an authenticated user to potentially enable escalation of privilege via local access...

Design/Logic Flaw

Incorrect default permissions in the Audio Service for some IntelR NUC P14E Laptop Element software for Windows 10 before version 1.0.0.156 may allow an authenticated user to potentially enable escalation of privilege via local access...

Design/Logic Flaw

Uncontrolled resource consumption in the IntelR UniteR android application before Release 17 may allow an authenticated user to potentially enable denial of service via local access...

Design/Logic Flaw

Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations. In versions 0.4.0 and 0.5.0, if an attacker is able allocate arbitrary many bytes in the Bitswap server, those allocations are lasting even if the connection is closed. This affects users acceptin...

Design/Logic Flaw

When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read returns an error. In rare deployment cases error thrown by the Read function, this could lead to a predictable shared secret. The tkn20 and blindrsa components did not...

Design/Logic Flaw

JB Inquiry form contains an exposure of private personal information to an unauthorized actor vulnerability, which may allow a remote unauthenticated attacker to obtain information entered from forms created using the affected product. The affected products and versions are as follows: JB Inquiry...

Design/Logic Flaw

An issue was discovered in Veritas InfoScale Operations Manager VIOM before 7.4.2.800 and 8.x before 8.0.410. The VIOM web application does not validate user-supplied data and appends it to OS commands and internal binaries used by the application. An attacker with root/administrator level...

Upgraded Q -> 2 from #298 [1683709930306]

Judge has assessed an item in Issue 298 as 2 risk. The relevant finding follows: L-01 Valid hex string is not decoded correctly by hexStringToBytes32 and reads memory out-of-boundary Links Impact Valid hexadecimal strings are not decoded correctly. Decoding reads out-of-bounds memory returning...

Design/Logic Flaw

Insufficient address validation, may allow an attacker with a compromised ABL and UApp to corrupt sensitive memory locations potentially resulting in a loss of integrity or availability...

Design/Logic Flaw

An issue found in Cesanta MJS v.1.26 allows a local attacker to cause a denial of service via the mjsexecute function in mjs.c...

Design/Logic Flaw

An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgpcapabilityllgr function...

Design/Logic Flaw

XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-2 and prior to versions 14.10.4 and 15.0-rc-1, it's possible for a user to execute anything with the right of the author of the XWiki.ClassSheet document. This has been patched in XWiki 15.0-rc-1 and 14.10.4. There are n...

Design/Logic Flaw

Insecure Permissons vulnerability found in ShopCMS YerShop all versions allows a remote attacker to escalate privileges via the coverid parameter...

Design/Logic Flaw

An issue found in libming v.0.4.8 allows a local attacker to execute arbitrary code via the parseSWFIMPORTASSETS function in the parser.c file...

Design/Logic Flaw

An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgpattrpsidsub function...

SUSE-SU-2023:2150-1 Security update for shim

This update for shim fixes the following issues: - Updated shim signature after shim 15.7 be signed back: signature-sles.x8664.asc, signature-sles.aarch64.asc bsc1198458 - Add POSTPROCESSPEFLAGS=-N to the build command in shim.spec to disable the NX compatibility flag when using post-process-pe...