Leaflet Map < 3.0.0 - Contributor+ Stored XSS

The plugin does not escape some shortcode attributes before they are used in JavaScript code or HTML, which could allow users with a role as low as Contributors to exploit stored XSS issues Most of the shortcode attributes are not escaped, so these are just one of them: leaflet-map...

CVE-2021-34382

Trusty TLK contains a vulnerability in the NVIDIA TLK kernel’s tzmapsharedmem function where an integer overflow on the size parameter causes the request buffer and the logging buffer to overflow, allowing writes to arbitrary addresses within the kernel...

Amazon Linux 2 : qemu (ALAS-2021-1671)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1671 advisory. A heap buffer overflow flaw was found in the iSCSI support of QEMU. This flaw could lead to an out-of- bounds read access and...

CVE-2021-24383

The WP Google Maps WordPress plugin before 8.1.12 did not sanitise, validate of escape the Map Name when output in the Map List of the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue...

CVE-2021-24383

The WP Google Maps WordPress plugin before 8.1.12 did not sanitise, validate of escape the Map Name when output in the Map List of the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue...

NVIDIA TLK 输入验证错误漏洞

Nvidia NVIDIA TLK is a scheduler from Nvidia Corporation of America for use with Trusted Firmware-A TF-A. NVIDIA TLK suffers from an Input Validation Error vulnerability that stems from Trusty TLK containing a vulnerability in the NVIDIA TLK kernel function, where a missing check allows...

CVE-2021-3433

Invalid channel map in CONNECTIND results to Deadlock. Zephyr versions = v2.5.0 Improper Check or Handling of Exceptional Conditions CWE-703. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3c2f-w4v6-qxrp...

Aptar CMS has a flawed logic vulnerability

Aptar CMS website management system adopts PHP+MYSQL technology, supports pseudo-static function, can generate google and baidu maps, supports custom url, keywords and description, and facilitates SEO search. Aptar CMS has a logic flaw vulnerability that can be exploited by attackers to compromis...

Nvidia NVIDIA TLK 输入验证错误漏洞

Nvidia NVIDIA TLK is a scheduler from Nvidia Corporation of America for use with Trusted Firmware-A TF-A. NVIDIA TLK suffers from an Input Validation Error vulnerability that stems from Trusty TLK containing a vulnerability in the NVIDIA TLK kernel function, where a missing check allows...

PT-2021-15916 · Unknown · Wp Google Maps

Name of the Vulnerable Software and Affected Versions: WP Google Maps versions prior to 8.1.12 Description: The issue is related to an authenticated Stored Cross-Site Scripting problem. It occurs because the Map Name is not properly sanitised, validated, or escaped when it is output in the Map Li...

The vulnerability of the arParams[API_KEY] parameter of the map.google component of the Bitrix24 service allows a hacker to execute arbitrary JavaScript code.

The vulnerability of the arParamsAPIKEY parameter in the map.google component of the Bitrix24 business management service exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary JavaScript code remotely...

WordPress Leaflet Map plugin <= 2.23.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by apple502j in WordPress Leaflet Map plugin versions = 2.23.3. Solution Update the WordPress Leaflet Map plugin to the latest available version at least 3.0.0...

samba: Negative idmap cache entries can cause incorrect group entries in the Samba file server process token

A flaw was found in samba. The Samba smbd file server must map Windows group identities SIDs into unix group ids gids. The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache...

PT-2024-11278 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the initialization of the usb2 PHY glue in the Linux kernel when only PHY1 is used, such as on the Odroid-HC4 device. The regmap init code uses the usb2 ports...

[SECURITY] Fedora 33 Update: mapserver-7.4.5-1.fc33

Mapserver is an internet mapping program that converts GIS data to map images in real time. With appropriate interface pages, Mapserver can provide an interactive internet map based on custom GIS data...

OSV-2021-801 UNKNOWN READ in std::__1::__tree<std::__1::__value_type<Json::Value::CZString, Json::Value>, std

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34665 Crash type: UNKNOWN READ Crash state: std::1::tree, std std::1::mapJson::Value::CZString, Json::Value, std::1::lessJson::Value::CZ Json::Value::begin...

GHSA-2CPX-427X-Q2C6 CHECK-fail in AddManySparseToTensorsMap

Impact An attacker can trigger a denial of service via a CHECK-fail in tf.rawops.AddManySparseToTensorsMap: python import tensorflow as tf import numpy as np sparseindices = tf.constant530, shape=1, 1, dtype=tf.int64 sparsevalues = tf.ones1, dtype=tf.int64 shape = tf.Variabletf.ones55,...

OSV-2021-776 UNKNOWN READ in std::__1::__tree<std::__1::__value_type<Json::Value::CZString, Json::Value>, std

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34443 Crash type: UNKNOWN READ Crash state: std::1::tree, std std::1::mapJson::Value::CZString, Json::Value, std::1::lessJson::Value::CZ Json::Value::begin...

PT-2021-18151 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy version 1.14.0 Description: An issue was discovered that allows for a remotely exploitable crash for HTTP2 Metadata. This occurs because an empty METADATA map triggers a Reachable Assertion. Recommendations: For Envoy version 1.14.0, at...

QEMU: assertion failure through usb_packet_unmap() in hw/usb/hcd-ehci.c

A reachable assertion vulnerability was found in the USB EHCI emulation code of QEMU. This issue occurs while processing USB requests due to missed handling of DMA memory map failure. This flaw allows a malicious privileged user within the guest to send bogus USB requests and crash the QEMU proce...