CVE-2023-42658 InSpec Archive Command Vulnerable to Maliciously Crafted Profile

Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile...

CVE-2023-40050

Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution...

CVE-2023-40050: Improper Control of Generation of Code

Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution...

CVE-2023-42658: Improper Control of Generation of Code

Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile...

CVE-2023-5557 Tracker-miners: sandbox escape

A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability...

Denial Of Service (DoS)

libhdf5.so is vulnerable to Denial Of Service DoS. The vulnerability exists due to the stack-based buffer overflow in H5Eint.c, which allows an attacker to cause an application crash by providing a maliciously crafted input...

Out-of-bounds Read

libopensc.so is vulnerable to out-of-bounds reads. The vulnerability exists in card-myeid.c because it does not properly validate symmetric keys, which allows an attacker to send maliciously crafted responses to the APDU and read information outside of the intended range...

Code injection

Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the init operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7...

CVE-2023-4782: Improper Limitation of a Pathname to a Restricted Directory

Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the init operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7...

CVE-2023-41064: Buffer Copy without Checking Size of Input

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted image may lead to arbitrary code execution...

CVE-2023-27932

A vulnerability was found in WebKitGTK. This security issue occurs when processing maliciously crafted web content that may bypass the same-origin Policy. Mitigation Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criter...

CVE-2023-39968 Open Redirect Vulnerability in jupyter-server

jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URL...

Amazon Linux 2023 : runc (ALAS2023-2023-311)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-311 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to...

CVE-2020-36615

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.0.1. Processing a maliciously crafted font may lead to arbitrary code execution...

Denial Of Service (DoS)

gitlab is vulnerable to Denial of Service DoS. The vulnerability exists due to the lack of length validation in the Snippet descriptions of the library, which allows an attacker to cause an application crash by submitting the maliciously large snippet...

Regular Expression Denial Of Service (ReDoS)

gitlab is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability exists in the Maven Package registry, allowing an attacker to cause an application crash by sending a maliciously crafted string...

Denial Of Service (DoS)

firefox is vulnerable to Denial Of Service DoS. The vulnerability exists due to the out of bound memory in the library, allowing an attacker to cause an application crash by providing a maliciously crafted favicon...

Denial Of Service (DoS)

golang.org/x/image is vulnerable to Denial Of Service DoS. The vulnerability exists because reader.go does not properly limit the size of compressed tiff data while decoding, which allows an attacker to cause an application slowdown by providing a maliciously crafted image...

GHSA-J3P8-6MRQ-6G7H Golang TIFF decoder vulnerable to excessive CPU consumption

A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size width height appearing to be zero...

CVE-2023-29407 Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff

A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size width height appearing to be zero...