ROS-2-539

2.539 PyYAML parser vulnerability CVE-2020-14343 1. Vulnerability description: A vulnerability in the PyYAML parser, is related to insufficient validation of user-entered data when processing unreliable YAML files using the fullload method or the FullLoader loader. Exploitation of the...

Node.js: process.binding() can bypass the permission model through path traversal

The use of the deprecated API process.binding allowed for bypassing the permission model in Node.js 20.x through path traversal...

GHSA-2QMJ-7962-CJQ8 langchain arbitrary code execution vulnerability

An issue in langchain allows an attacker to execute arbitrary code via the PALChain in the python exec method...

PT-2023-25499 · Langchain · Langchain

Name of the Vulnerable Software and Affected Versions: LangChain versions prior to 0.0.236 Description: The issue allows an attacker to execute arbitrary code because Python code with os.system, exec, or eval can be used. This is possible via the PALChain in the python exec method. Recommendation...

PT-2023-5558

Name of the Vulnerable Software and Affected Versions: Apache Jackrabbit versions 2.20.10 and earlier stable branch Apache Jackrabbit versions 2.21.17 and earlier unstable branch Description: A Java object deserialization issue in Apache Jackrabbit webapp/standalone on all platforms allows an...

CLSA-2023-1688070599 Fix CVE(s): CVE-2023-28322, CVE-2023-28321

SECURITY UPDATE: More POST-after-PUT confusion - debian/patches/CVE-2023-28322.patch: fix mess in upload/method handling - CVE-2023-28322 SECURITY UPDATE: incorrect IDN wildcard match - debian/patches/CVE-2023-28321.patch: fix erroneous logic in wildcard handling, drop support for wildcards in th...

CLSA-2023-1688070248 Fix CVE(s): CVE-2023-28322

SECURITY UPDATE: More POST-after-PUT confusion - debian/patches/CVE-2023-28322.patch: fix mess in upload/method handling - CVE-2023-28322...

CVE-2023-32223

D-Link DSL-224 firmware version 3.0.10 allows post authentication command execution via an unspecified method...

CVE-2023-32223

D-Link DSL-224 firmware version 3.0.10 allows post authentication command execution via an unspecified method...

CVE-2023-32222

D-Link DSL-G256DG version vBZ1.00.27 web management interface allows authentication bypass via an unspecified method...

CVE-2023-21192

In setInputMethodWithSubtypeIdLocked of InputMethodManagerService.java, there is a possible way to setup input methods that are not enabled due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not...

Arbitrary Code Execution

langchain is vulnerable to Arbitrary Code Execution. The vulnerability exists because it does not properly validate the loadprompt method, which allows an attacker to execute malicious code on the system...

Google Pixel: Input validation vulnerability

Google Pixel is a smartphone from Google, an American company. Google Pixel suffers from a security vulnerability that originates in setInputMethodWithSubtypeIdLocked in InputMethodManagerService.java, which may bypass notifications to hide preferences due to improper input validation, which coul...

PT-2023-17980 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android version Android-13 Description: The issue is related to improper input validation in the setInputMethodWithSubtypeIdLocked function of InputMethodManagerService.java. This could lead to local escalation of privilege with no additional...

CVE-2023-32223 D-Link DSL-224 firmware version 3.0.10 post authentication command execution

D-Link DSL-224 firmware version 3.0.10 allows post authentication command execution via an unspecified method...

CVE-2023-32222 D-Link DSL-G256DG firmware version vBZ_1.00.27 Authentication Bypass

D-Link DSL-G256DG version vBZ1.00.27 web management interface allows authentication bypass via an unspecified method...

June 28, 2023—KB5027292 (OS Build 22000.2124) Preview

None None...

CVE-2023-32223 D-Link DSL-224 firmware version 3.0.10 post authentication command execution

D-Link DSL-224 firmware version 3.0.10 allows post authentication command execution via an unspecified method...

Server side request forgery (ssrf)

BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions are affected by a Server-Side Request Forgery SSRF vulnerability. In an insertDocument API request the user is able to supply a URL from which the presentation should be...

UBUNTU-CVE-2023-35169

PHP-IMAP is a wrapper for common IMAP communication without the need to have the php-imap module installed / enabled. Prior to version 5.3.0, an unsanitized attachment filename allows any unauthenticated user to leverage a directory traversal vulnerability, which results in a remote code executio...