397394 matches found
GHSA-5GFJ-9Q3V-QFP3 music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort
Summary The Matroska/WebM EBML parser decodes attacker-controlled variable-length integer VINT element lengths without first validating that the declared element fits within its enclosing container or the available input. Leaf lengths are then used directly for string-token and Uint8Array...
NPM: music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort
NPM: music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort vulnerability discovered by ? in WordPress Npm music-metadata versions 11.16.0...
music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort
Summary The Matroska/WebM EBML parser decodes attacker-controlled variable-length integer VINT element lengths without first validating that the declared element fits within its enclosing container or the available input. Leaf lengths are then used directly for string-token and Uint8Array...
GHSA-48QF-XH34-Q73R MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters
Description When encoding a GeoJSON Polygon or MultiPolygon parameter for the binary protocol, the connector sized its output buffer from the length property of each ring, then wrote each ring only if it was a real array. The two loops disagreed: any non-array ring carrying a numeric length a...
NPM: MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters
NPM: MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters vulnerability discovered by ? in WordPress Npm mariadb versions 3.2.5...
MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters
Description When encoding a GeoJSON Polygon or MultiPolygon parameter for the binary protocol, the connector sized its output buffer from the length property of each ring, then wrote each ring only if it was a real array. The two loops disagreed: any non-array ring carrying a numeric length a...
GHSA-W6R9-248C-FRG8 amqp091-go: Pre-negotiation frame limit is not enforced to 4KB
Summary The frame-size mitigation released in amqp091-go v1.13.0 can be bypassed before connection.tune completes. A malicious or compromised AMQP peer can send only a seven-byte body-frame header containing a large attacker-controlled uint32 payload length. The client allocates a slice of that...
amqp091-go: Pre-negotiation frame limit is not enforced to 4KB
Summary The frame-size mitigation released in amqp091-go v1.13.0 can be bypassed before connection.tune completes. A malicious or compromised AMQP peer can send only a seven-byte body-frame header containing a large attacker-controlled uint32 payload length. The client allocates a slice of that...
evil-mhyprot-cli
evil-mhyprot-cli Una PoC per il driver vulnerabile Mhyprot2.sys che consente la lettura/scrittura della memoria in kernel/user tramite un processo utente non privilegiato. libmhyprot Wiki Panoramica Cosa possiamo fare con questa CLI è il seguente: Leggere/Scrivere qualsiasi memoria del kernel con...
CVE-2026-84290
IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improper validation of user-supplied pointers in the WfpMonitor kernel driver. Certain METHODNEITHER IOCTL handlers dereference user-controlled pointers without adequate probing and exception handling, potentially allowing a privileg...
Important: Red Hat Security Advisory: bind9.16 security, bug fix, and enhancement update
An update for bind9.16 is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...
bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation
A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending maliciously-constructed packets to BIND servers configured for TKEY-based authentication via GSS-API Generic Security Service Application Program Interface tokens. This can lead to excessive memory consumption,...
bind: bind9: Potential memory usage beyond configured limits
A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the...
DEBIAN-CVE-2026-107386
amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or...
CVE-2026-107387
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size and allocates a Uint8Array for a binary item before proving that the declared item fits in the remaining tag or file data. A small crafted APE file ca...
CVE-2026-107386
amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or...
CVE-2026-107386
amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or...
DEBIAN-CVE-2026-106433
Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document,...
DEBIAN-CVE-2026-106437
The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an...
DEBIAN-CVE-2026-106431
An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent...