CVE-2025-22384

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in specific scenarios where requests are altered before reaching...

PT-2025-32244

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 139.0.7258.66 Description A use-after-free issue existed in the Extensions component of Google Chrome. This allowed a remote attacker to potentially exploit heap corruption through a crafted Chrome Extension. Th...

Microsoft Dynamics 365 Business Central Auth Bypass Privilege Escalation

The vulnerability of the Microsoft Dynamics 365 Business Central software for small and medium-sized businesses is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to gain increased privileges remotely...

grok:grk_decompress_fuzzer: Heap-buffer-overflow in grk::PacketIter::next_lrcp

Project: https://github.com/GrokImageCompression/grok.git https://github.com/GrokImageCompression/grok-test-data.git Detailed Report: https://oss-fuzz.com/testcase?key=5319359051923456 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzerasangrok Platform Id...

CBL Mariner 2.0 Security Update: python3 / tensorflow (CVE-2024-6923)

The version of python3 / tensorflow installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-6923 advisory. - There is a MEDIUM severity vulnerability affecting CPython. The email module didn't properly...

ONLY Cynet Delivers 100% Protection and 100% Detection Visibility in the 2024 MITRE ATT&CK Evaluation

Across small-to-medium enterprises SMEs and managed service providers MSPs, the top priority for cybersecurity leaders is to keep IT environments up and running. To guard against cyber threats and prevent data breaches, it's vital to understand the current cybersecurity vendor landscape and...

Advisory ROSA-SA-2024-2543

software: trousers 0.3.14 WASP: ROSA-CHROME packageevrstring: trousers-0.3.14-5 CVE-ID: CVE-2020-24332 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: Vulnerability in TrouSerS: Vulnerability to create system.data files when running the tcsd daemon with root privileges. CVE-STATUS: The vulnerability has...

ffmpeg:ffmpeg_dem_WTV_fuzzer: Use-of-uninitialized-value in ff_parse_mpeg2_descriptor

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5144130618982400 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegdemWTVfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2024-770)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-770 advisory. There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted...

ffmpeg:ffmpeg_dem_MLV_fuzzer: Use-of-uninitialized-value in scan_file

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4696002884337664 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegdemMLVfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

CosmWasm VM Incorrect metering

CWA-2024-007 Severity Medium Moderate + Likely^1 Affected versions: - wasmvm = 2.1.0, = 2.0.0, = 2.1.0, = 2.0.0, query wasm libwasmvm-version. It must show 1.5...

graphicsmagick:coder_HEIF_fuzzer: Heap-buffer-overflow in derive_collocated_motion_vectors

Detailed Report: https://oss-fuzz.com/testcase?key=4731099328086016 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderHEIFfuzzer Job Type: libfuzzerasangraphicsmagick Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x51b00000df32 Crash State:...

libbpf:bpf-object-fuzzer: Crash in btf_ext_parse_sec_info

Detailed Report: https://oss-fuzz.com/testcase?key=4792341350645760 Project: libbpf Fuzzing Engine: libFuzzer Fuzz Target: bpf-object-fuzzer Job Type: libfuzzerasani386libbpf Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xf16a0112 Crash State: btfextparsesecinfo btfextparseinfo...

unrar:unrar_fuzzer: Use-of-uninitialized-value in Archive::UnexpEndArcMsg

Detailed Report: https://oss-fuzz.com/testcase?key=5182531311304704 Project: unrar Fuzzing Engine: libFuzzer Fuzz Target: unrarfuzzer Job Type: libfuzzermsanunrar Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: Archive::UnexpEndArcMsg Archive::ReadHeader50...

ndpi:fuzz_ndpi_reader_pl7m: Use-of-uninitialized-value in keep_extra_dissection

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=4576116020412416 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzndpireaderpl7m Job Type: libfuzzermsanndpi Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

CVE-2024-9404

CVE-2024-9404 concerns a DoS vulnerability in MOXA devices caused by insufficient input validation in the moxa_cmd service, leading to potential service disruption or crashes when exposed to networks. The initial CVE entry documents a high-severity impact with CVSS scores (3.1: 7.5/ HIGH and 4.0:...

CVE-2024-53983

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

CVE-2024-53983 Server-side request forgery in Backstage Scaffolder plugin

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

WordPress SEO Landing Page Generator Plugin <= 1.66.2 is vulnerable to Cross Site Scripting (XSS)

Software SEO Landing Page Generator Type Plugin Vulnerable versions = 1.66.2 Fixed in 1.66.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-11366 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0d742f2bf7f0 Credits vgo0...

WordPress FAQ Builder AYS Plugin <= 1.7.1 is vulnerable to Cross Site Scripting (XSS)

Software FAQ Builder AYS Type Plugin Vulnerable versions = 1.7.1 Fixed in 1.7.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-11458 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4525aff9e72c Credits vgo0 Required...