CVE-2024-0232 Sqlite: use-after-free bug in jsonparseaddnodearray

A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service...

sqlite -- use-after-free bug in jsonparseaddnodearray

[email protected] reports: A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading t...

Mutation Cross Site Scripting (mXSS)

OWASP AntiSamy is vulnerable to Mutation Cross Site Scripting mXSS. The vulnerability is due to improper parsing of HTML when the preserveComments directive is enabled in the policy. This issue can be exploited by an attacker by injecting malicious input to execute arbitrary JavaScript...

CVE-2023-50246

A heap-based buffer overflow vulnerability was found in the decToString function in decNumber.c in the Jq project. This issue occurs when submitting malicious input to the application, leading to an application crash and causing a denial of service...

CVE-2023-40446

The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.7.1, iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1. Processing maliciously crafted input may lead to arbitrary code execution in user-installed apps...

Denial Of Service (DoS)

openjdk is vulnerable to Denial Of Service DoS. An attacker can cause an application crash through the multiple protocols by providing a malicious input...

PT-2023-7472 · Unknown · Google-Translate-Api-Browser

Name of the Vulnerable Software and Affected Versions: google-translate-api-browser versions prior to 4.1.3 Description: A Server-Side Request Forgery SSRF issue is present in applications utilizing the google-translate-api-browser package and exposing the translateOptions to the end user. An...

yajl: Memory leak in yajl_tree_parse function

A flaw was found in the yajl library, which exists due to a memory leak within the yajltreeparse function. This flaw allows a remote attacker to parse malicious JSON input to cause out-of-memory in the server, causing a crash, resulting in a denial of service attack...

go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents

A flaw was found in go-yaml. This issue causes the consumption of excessive amounts of CPU or memory when attempting to parse a large or maliciously crafted YAML document...

go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents

A flaw was found in go-yaml. This issue causes the consumption of excessive amounts of CPU or memory when attempting to parse a large or maliciously crafted YAML document...

Buffer Overflow

libfile.so is vulnerable to Buffer Overflow. The vulnerability exists due to the stack-based buffer over-read in the filecopystr function of funcs.c, which allows an attacker to cause an application crash through a maliciously crafted input...

less: Denial of service

Background less is a pager and text file viewer. Description less suffered from a flaw in its terminal escape sequence handling which made its filtering incomplete. Impact Malicious input could clear the terminal output or otherwise manipulate it with faked interactions. Workaround There is no...

CVE-2023-43646

get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service redos vulnerability which may lead to a denial of service when parsing malicious input. This vulnerabilit...

get-func-name Security Vulnerability

get-func-name is a Chaijs open source module for securely and consistently retrieving function names in NodeJS and browsers. A security vulnerability exists in get-func-name versions prior to 2.0.1, which stems from a regular expression denial-of-service redos vulnerability in the system that cou...

CVE-2023-43646 Inefficient Regular Expression Complexity in get-func-name

get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service redos vulnerability which may lead to a denial of service when parsing malicious input. This vulnerabilit...

PT-2023-5403 · Ashlar Vellum · Ashlar-Vellum Cobalt

Name of the Vulnerable Software and Affected Versions: Ashlar-Vellum Cobalt affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations. The flaw exists within the parsing of AR files due to the lack of proper validation of...

GHSA-X4HH-VJM7-G2JV Faktory Web Dashboard can lead to denial of service(DOS) via malicious user input

Summary Faktory web dashboard can suffer from denial of service by a crafted malicious url query param days. Details The vulnerability is related to how the backend reads the days URL query parameter in the Faktory web dashboard. The value is used directly without any checks to create a string...

snappy-java: Integer overflow in compress leads to DoS

A flaw was found in Snappy-java's shuffle function, which does not check input sizes before beginning operations. This issue could allow an attacker to send malicious input to trigger an overflow error that crashes the program, resulting in a denial of service...

Denial Of Service (DoS)

tcpreplay is vulnerable to Denial Of Service DoS. The vulnerability exists in the tcpeditdltcleanup function of dltplugins.c, which allows an attacker to cause an application crash by providing a maliciously crafted input...

Denial Of Service (DoS)

tcpreplay is vulnerable to Denial Of Service DoS. The vulnerability exists in the macinstring function of the library, which allows an attacker to cause an application crash through the maliciously crafted input...