Auto-GPT 代码注入漏洞

Auto-GPT is an artificial intelligence software agent program open-sourced by Significant Gravitas. A code injection vulnerability exists in versions of Auto-GPT prior to 0.4.3, which stems from the ability to achieve arbitrary code execution on a host running Auto-GPT by overwriting...

PT-2023-9364 · Stb Image +3 · Stb Image +3

Name of the Vulnerable Software and Affected Versions: stb image affected versions not specified Description: The issue is related to a double-free memory error in the stbi load gif main component of the stb image library. This can be triggered by a crafted image file, potentially allowing a remo...

XSS vulnerabilities via various embeds

Description JSFiddle, Gliffy, Otter and Tldraw embeds lack sufficient input validation. Every one of them can be abused to achieve a stored XSS on a main application domain. This XSS triggers for everyone viewing the document. Proof of Concept PoC file is different for each vulnerable embed. See...

CVE-2023-37202

Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free. This vulnerability affects Firefox 115, Firefox ESR 102.13, and Thunderbird 102.13...

Important: kernel-livepatch-4.14.313-235.533

Issue Overview: dotlsgetsockopt in net/tls/tlsmain.c in the Linux kernel through 6.2.6 lacks a locksock call, leading to a race condition with a resultant use-after-free or NULL pointer dereference. CVE-2023-28466 Affected Packages: kernel-livepatch-4.14.313-235.533 Issue Correction: Please ensur...

The vulnerability of the decode_main_header() function (libavformat/nutdec.c) in the FFmpeg multimedia library allows a attacker to cause a service failure.

The vulnerability of the decodemainheader function libavformat/nutdec.c in the FFmpeg multimedia library is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2023-5278 · D Link · D-Link Dir-645

Name of the Vulnerable Software and Affected Versions: D-Link DIR-645 version 1.03 Description: The issue is related to an Authentication Bypass vulnerability that allows remote attackers to gain escalated privileges. This is due to insufficient access control in the phpcgi main function in cgibi...

SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2023:2534-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2534-1 advisory. The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes. The following security...

CVE-2023-35827

An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravbremove in drivers/net/ethernet/renesas/ravbmain.c...

DEBIAN-CVE-2023-35827

An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravbremove in drivers/net/ethernet/renesas/ravbmain.c...

CVE-2023-34800

D-Link Go-RT-AC750 revAv101b03 was discovered to contain a command injection vulnerability via the service parameter at genacgimain...

Microsoft Warns of New Russian State-Sponsored Hacker Group with Destructive Intent

Microsoft on Wednesday took the lid off a "novel and distinct Russian threat actor," which it said is linked to the General Staff Main Intelligence Directorate GRU and has a "relatively low success rate." The tech giant's Threat Intelligence team, which was previously tracking the group under its...

编号撤回

glib2 is a general-purpose, portable utility library open-sourced by GNOME. Many useful data types, macros, type conversions, string utilities, file utilities, main loop abstractions, etc. are provided. This CVE number has been withdrawn...

DEBIAN-CVE-2023-34823

fdkaac before 1.0.5 was discovered to contain a stack overflow in readcallback function in src/main.c...

fdkaac 缓冲区错误漏洞

fdkaac is a command-line front-end for the libfdk-aac encoder by the Japanese individual developer nu774. A security vulnerability exists in versions of fdkaac prior to 1.0.5, which stems from the discovery of a stack overflow vulnerability via the readcallback function in src/main.c. The...

PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)

Exploit Title: PyLoad 0.5.0 - Pre-auth Remote Code Execution RCE Date: 06-10-2023 Credits: bAu @bauh0lz Exploit Author: Gabriel Lima 0xGabe Vendor Homepage: https://pyload.net/ Software Link: https://github.com/pyload/pyload Version: 0.5.0 Tested on: Ubuntu 20.04.6 CVE: CVE-2023-0297 import...

Cross-Site Scripting (XSS)

org.apache.jspwiki:jspwiki-main is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape the special characters in the PARAMPAGE parameter before it output to the front end in several plugins, allowing an attacker to inject and execute malicious JavaScript on victim...

mainstreetmarketokotoks.com Cross Site Scripting vulnerability OBB-3397446

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-25730

A background script invoking requestFullscreen and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox 110, Thunderbird 102.8, and Firefox ESR 102.8...

DEBIAN-CVE-2023-25730

A background script invoking requestFullscreen and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox 110, Thunderbird 102.8, and Firefox ESR 102.8...