1043 matches found
CVE-2023-0624
OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html...
CVE-2023-6159
An issue has been discovered in GitLab CE/EE affecting all versions from 12.7 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 It was possible for an attacker to trigger a Regular Expression Denial of Service via a Cargo.toml containing maliciously crafted input...
CVE-2021-21812
A stack-based buffer overflow vulnerability exists in the command-line-parsing HandleFileArg functionality of AT Labs’ Xmill 0.7. Within the function HandleFileArg the argument filepattern is under control of the user who passes it in from the command line. filepattern is passed directly to strcp...
CVE-2021-21904
A directory traversal vulnerability exists in the CMA CLI setenv command of Garrett Metal Detectors’ iC Module CMA Version 5.0. An attacker can provide malicious input to trigger this vulnerability...
CVE-2020-6976
Delta Industrial Automation CNCSoft ScreenEditor, v1.00.96 and prior. An out-of-bounds read overflow can be exploited when a valid user opens a specially crafted, malicious input file due to the lack of validation...
CVE-2020-16159
GoPro gpmf-parser 1.5 has a heap out-of-bounds read and segfault in GPMFScaledData. Parsing malicious input can result in a crash or information disclosure...
CVE-2020-16161
GoPro gpmf-parser 1.5 has a division-by-zero vulnerability in GPMFScaledData. Parsing malicious input can result in a crash...
CVE-2019-19551
In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the User Management screen of the Administrator web site. An attacker with access to the User Control Panel application can submit malicious values in some of the time/date formatting and time-zone fields. These fields are no...
CVE-2019-10984
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user opens a specially crafted, malicious input file that causes the program to mishandle pointers...
CVE-2019-10978
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user opens a specially crafted, malicious input file that operates outside of the designated memory area...
Adobe Dimension Out-of-Bounds Write Vulnerability
Adobe Dimension is an application for 3D design and rendering. An out-of-bounds write vulnerability exists in Adobe Dimension. The vulnerability is due to a component of the program failing to properly manage memory boundaries when processing specific input. An attacker could exploit the...
Regular Expression Denial of Service (ReDoS)
Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the search function. An attacker can occupy excessive system resources by passing a malicious string with nested groups as the query parameter. PoC https://xxxx.sso.com/search?query=.11...
USN-7435-1 protobuf vulnerability
It was discovered that Protocol Buffers incorrectly handled memory when receiving malicious input using the Java bindings. An attacker could possibly use this issue to cause a denial of service...
USN-7435-1: Protocol Buffers vulnerability
It was discovered that Protocol Buffers incorrectly handled memory when receiving malicious input using the Java bindings. An attacker could possibly use this issue to cause a denial of service...
Cross-site Scripting (XSS)
Overview fprime-gds is a F Prime Flight Software Ground Data System layer Affected versions of this package are vulnerable to Cross-site Scripting XSS on the Run Commands table. An attacker can execute scripts in the context of the browser by injecting malicious strings as cmdDisp.CMDNOOPSTRING...
kernel: HID: core: zero-initialize the report buffer
A vulnerability was found in the Linux kernel's driver for Human Interface Devices. This flaw allows an attacker to use a malicious input device to read information from the report buffer. This could be used to leak kernel memory, enabling the exploitation of additional vulnerabilities...
kernel: HID: core: zero-initialize the report buffer
A vulnerability was found in the Linux kernel's driver for Human Interface Devices. This flaw allows an attacker to use a malicious input device to read information from the report buffer. This could be used to leak kernel memory, enabling the exploitation of additional vulnerabilities...
kernel: HID: core: zero-initialize the report buffer
A vulnerability was found in the Linux kernel's driver for Human Interface Devices. This flaw allows an attacker to use a malicious input device to read information from the report buffer. This could be used to leak kernel memory, enabling the exploitation of additional vulnerabilities...
kernel: HID: core: zero-initialize the report buffer
A vulnerability was found in the Linux kernel's driver for Human Interface Devices. This flaw allows an attacker to use a malicious input device to read information from the report buffer. This could be used to leak kernel memory, enabling the exploitation of additional vulnerabilities...