CVE-2023-47635

CVE-2023-47635 concerns Decidim (Ruby on Rails) where the CSRF authenticity token check is disabled for the questionnaire templates preview in versions ≤ 0.27.4 and 0.28.0 before the fix. The risk is limited by the requirement that an attacker must also access the user session cookie to view the ...

CVE-2023-47634

CVE-2023-47634 affects Decidim, a Ruby on Rails participatory democracy framework. The vulnerability is a race condition in the endorsement of resources (e.g., proposals) that can allow a user to submit more than one endorsement when multiple endorsement requests are sent in parallel. Affected ve...

CVE-2024-21723

CVE-2024-21723 describes an open redirect in the Joomla! core installation application caused by inadequate URL parsing. Public docs consistently identify this as an Open Redirect vulnerability in Joomla! installation, enabling redirection to an arbitrary URL when a crafted link is processed. The...

CVE-2024-21725

CVE-2024-21725 describes an XSS vulnerability due to inadequate escaping of email addresses in various Joomla! components. Affected product: Joomla! CMS (web components referencing mail address outputs). Root cause: inadequate escaping of email addresses. Impact (as stated in sources): cross-site...

CVE-2024-21724

Joomla! CMS core contains a Cross-site Scripting (XSS) vulnerability due to inadequate input validation in media selection fields (CVE-2024-21724). Affected software: Joomla! core components handling media selection in extensions. Root cause: insufficient validation in media selection input paths...

CVE-2024-21722

The issue CVE-2024-21722 affects Joomla! CMS: the MFA management views did not properly terminate existing user sessions when a user’s MFA methods were modified. The root cause is insufficient session expiration tied to MFA changes, which can allow previously authenticated sessions to persist aft...

CVE-2024-21726

Summary (CVE-2024-21726): In Joomla! ecosystems (CMS and Framework), inadequate content filtering in the filter code can allow cross-site scripting (XSS) in multiple components. The CVE is documented with a CVSS v3.1 base score of 6.5 (Network, Low/Low impacts except Confidentiality: Low, Availab...

Double free

A double-free vulnerability exists in the BrainVision Header Parsing functionality of The Biosig Project libbiosig Master Branch ab0ee111 and 2.5.0. A specially crafted .vdhr file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability...

Integer overflow

An integer underflow vulnerability exists in the sopenFAMOSread functionality of The Biosig Project libbiosig 2.5.0 and Master Branch ab0ee111. A specially crafted .famos file can lead to an out-of-bounds write which in turn can lead to arbitrary code execution. An attacker can provide a maliciou...

Integer overflow

An integer overflow vulnerability exists in the sopenFAMOSread functionality of The Biosig Project libbiosig 2.5.0 and Master Branch ab0ee111. A specially crafted .famos file can lead to an out-of-bounds write which in turn can lead to arbitrary code execution. An attacker can provide a malicious...

Heap overflow

A heap-based buffer overflow vulnerability exists in the .egi parsing functionality of The Biosig Project libbiosig 2.5.0 and Master Branch ab0ee111. A specially crafted .egi file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability...

Design/Logic Flaw

A use-after-free vulnerability exists in the sopenFAMOSread functionality of The Biosig Project libbiosig 2.5.0 and Master Branch ab0ee111. A specially crafted .famos file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2024-1470

CVE-2024-1470 pertains to NetIQ (OpenText) Client Login Extension on Windows, version 4.6, with an "Authorization Bypass Through User-Controlled Key" that leads to privilege escalation and code injection. Multiple connected sources corroborate the affected product/version and the underlying issue...

CVE-2024-22097

CVE-2024-22097 : A double-free vulnerability in The Biosig Project’s libbiosig, specifically in the BrainVision Header Parsing code for the Master Branch (commit ab0ee111) and version 2.5.0. A crafted BrainVision (.vdhr) file can trigger the flaw, enabling arbitrary code execution. The vulnerabil...

CVE-2024-23305

CVE-2024-23305 affects The Biosig Project’s BrainVisionMarker Parsing in libbiosig 2.5.0 and the Master branch (ab0ee111). A crafted .vmrk file can trigger an out-of-bounds write, leading to arbitrary code execution and a remote, unauthenticated impact as described in multiple sources (CVSSv3.1: ...

CVE-2024-21795

CVE-2024-21795 describes a heap-based buffer overflow in The Biosig Project’s libbiosig 2.5.0 and its Master Branch (ab0ee111) within the .egi parsing code. A specially crafted .egi file can trigger arbitrary code execution. Public references (NVD, OSV, Nessus/NASL feeds) confirm the vulnerable c...

CVE-2024-23809

CVE-2024-23809 affects The Biosig Project’s libbiosig 2.5.0 and the Master branch (ab0ee111). A double-free in the BrainVision ASCII Header Parsing can allow arbitrary code execution via a crafted .vdhr file. Impact: high/critical as per CVSS 3.1 (Network, no user interaction). Remediation in pub...

CVE-2024-23313

The CVE-2024-23313 issue affects The Biosig Project libbiosig 2.5.0 and the Master branch (ab0ee111) via an integer underflow in sopen_FAMOS_read that can cause an out-of-bounds write and potentially arbitrary code execution when processing a crafted .famos file. Exploitation requires a malicious...

CVE-2024-21812

CVE-2024-21812 affects The Biosig Project libbiosig 2.5.0 and Master (ab0ee111). The sopen_FAMOS_read function contains an integer overflow that can trigger an out-of-bounds write, enabling arbitrary code execution via a specially crafted .famos file. Connected sources confirm the vulnerability d...

CVE-2024-23310

A use-after-free in The Biosig Project libbiosig 2.5.0 and master (ab0ee111) in sopen_FAMOS_read can be triggered by a crafted .famos file, enabling arbitrary code execution. Fedora advisory notes mitigation by disabling FAMOS input with BIOSIG_FAMOS_TRUST_INPUT=1; no broader patch/version detail...