D-Link DIR-645 安全漏洞

The D-Link DIR-645 is a wireless router from the Chinese company D-Link. A security vulnerability exists in the D-Link DIR-645 that originates from an authentication bypass via the phpcgimain function in cgibin...

PT-2023-4061 · D Link · D-Link Dir-895

Name of the Vulnerable Software and Affected Versions: D-Link DIR-895 version FW102b07 Description: The issue is related to a function called phpcgi main in the D-Link DIR-895 router's firmware, which has weaknesses in its authentication procedure. This can be exploited by a remote attacker to ga...

D-Link DIR-895 安全漏洞

The D-Link DIR-895 is a wireless router from China's AUO D-Link. The D-Link DIR-895 suffers from an authentication bypass vulnerability that stems from the lack of valid authentication in the phpcgimain function in cgibin, which can be exploited by an attacker to bypass authentication...

The vulnerability in the main() function of the cli/wvunpack.c component of the WavPack audio codec allows a hacker to cause a service failure.

The vulnerability of the main function in the cli/wvunpack.c component of the WavPack audio codec is related to pointer arithmetic errors. Exploiting this vulnerability allows an attacker to cause a service failure by using a specially created file...

CERT-UA Uncovers Gamaredon's Rapid Data Exfiltration Tactics Following Initial Compromise

The Russia-linked threat actor known as Gamaredon has been observed conducting data exfiltration activities within an hour of the initial compromise. "As a vector of primary compromise, for the most part, emails and messages in messengers Telegram, WhatsApp, Signal are used, in most cases, using...

CVE-2023-21248

In getAvailabilityStatus of WifiScanningMainSwitchPreferenceController.java, there is a possible way to bypass a device policy restriction due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not...

PT-2023-9364 · Stb Image +3 · Stb Image +3

Name of the Vulnerable Software and Affected Versions: stb image affected versions not specified Description: The issue is related to a double-free memory error in the stbi load gif main component of the stb image library. This can be triggered by a crafted image file, potentially allowing a remo...

PT-2023-9362 · Stb Image +3 · Stb Image +3

Name of the Vulnerable Software and Affected Versions: stb image affected versions not specified Description: The issue is related to the stbi load gif from memory component of the stb image library, which is a single file MIT licensed library for processing images. If stbi load gif main fails, i...

Auto-GPT 代码注入漏洞

Auto-GPT is an artificial intelligence software agent program open-sourced by Significant Gravitas. A code injection vulnerability exists in versions of Auto-GPT prior to 0.4.3, which stems from the ability to achieve arbitrary code execution on a host running Auto-GPT by overwriting...

XSS vulnerabilities via various embeds

Description JSFiddle, Gliffy, Otter and Tldraw embeds lack sufficient input validation. Every one of them can be abused to achieve a stored XSS on a main application domain. This XSS triggers for everyone viewing the document. Proof of Concept PoC file is different for each vulnerable embed. See...

CVE-2023-37202

Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free. This vulnerability affects Firefox 115, Firefox ESR 102.13, and Thunderbird 102.13...

Important: kernel-livepatch-4.14.313-235.533

Issue Overview: dotlsgetsockopt in net/tls/tlsmain.c in the Linux kernel through 6.2.6 lacks a locksock call, leading to a race condition with a resultant use-after-free or NULL pointer dereference. CVE-2023-28466 Affected Packages: kernel-livepatch-4.14.313-235.533 Issue Correction: Please ensur...

The vulnerability of the decode_main_header() function (libavformat/nutdec.c) in the FFmpeg multimedia library allows a attacker to cause a service failure.

The vulnerability of the decodemainheader function libavformat/nutdec.c in the FFmpeg multimedia library is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2023-5278 · D Link · D-Link Dir-645

Name of the Vulnerable Software and Affected Versions: D-Link DIR-645 version 1.03 Description: The issue is related to an Authentication Bypass vulnerability that allows remote attackers to gain escalated privileges. This is due to insufficient access control in the phpcgi main function in cgibi...

SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2023:2534-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2534-1 advisory. The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes. The following security...

CVE-2023-35827

An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravbremove in drivers/net/ethernet/renesas/ravbmain.c...

DEBIAN-CVE-2023-35827

An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravbremove in drivers/net/ethernet/renesas/ravbmain.c...

CVE-2023-34800

D-Link Go-RT-AC750 revAv101b03 was discovered to contain a command injection vulnerability via the service parameter at genacgimain...

Microsoft Warns of New Russian State-Sponsored Hacker Group with Destructive Intent

Microsoft on Wednesday took the lid off a "novel and distinct Russian threat actor," which it said is linked to the General Staff Main Intelligence Directorate GRU and has a "relatively low success rate." The tech giant's Threat Intelligence team, which was previously tracking the group under its...

编号撤回

glib2 is a general-purpose, portable utility library open-sourced by GNOME. Many useful data types, macros, type conversions, string utilities, file utilities, main loop abstractions, etc. are provided. This CVE number has been withdrawn...