CVE-2024-24262

CVE-2024-24262 affects media-server v1.0.0 with a Use-After-Free in sip_uac_stop_timer ( /uac/sip-uac-transaction.c ). Root cause: UAF in the timer handling path. Impact stated as high availability risk (network-exposed, no authentication, no user interaction). Exploitation details are not provid...

CVE-2024-24266

CVE-2024-24266 affects gpac v2.2.1 with a Use-After-Free (UAF) in dasher_configure_pid (src/filters/dasher.c). Multiple sources (NVD, Red Hat, OSV, CVE lists) confirm the vulnerability in gpac 2.2.1 and attribute it to dasher.c. CVSS v3.1 base score 7.5 (High) with NETWORK attack vector, LOW atta...

CVE-2024-23049

CVE-2024-23049 affects Symphony (v3.6.3 and earlier). The vulnerability enables remote code execution via the log4j component, with impact on confidentiality, integrity, and availability reported as High. Affected is Symphony’s log4j handling; root cause details are not fully enumerated in the pr...

CVE-2024-24259

CVE-2024-24259 affects freeglut (up to version 3.4.0) with a memory leak in glutAddMenuEntry. The connected Nessus advisories reiterate the issue path and relate it to other freeglut memory-leak CVE-2024-24258 in glutAddSubMenu. No patch/version fix details are provided in the supplied documents;...

Code injection

Malwarebytes Binisoft Windows Firewall Control before 6.9.9.2 allows remote attackers to execute arbitrary code via gRPC named pipes...

Design/Logic Flaw

libexpat through 2.5.0 allows recursive XML Entity Expansion if XMLDTD is undefined at compile time...

CVE-2021-4435

CVE-2021-4435 describes an untrusted search path vulnerability in Yarn. The issue can allow execution of malicious commands when a victim runs certain Yarn commands in a directory containing attacker-controlled content. Impact details in the NVD entry show a high-severity, local attack with requi...

CVE-2018-25098

The CVE-2018-25098 issue affects the Blockmason blockmason credit-protocol UCAC Handler, specifically the executeUcacTx function in contracts/CreditProtocol.sol. The vulnerability is described as a denial of service caused by the manipulation of that function. The product reportedly does not use ...

Code injection

A Marvin vulnerability side-channel leakage was found in the RSA decryption operation in the Linux Kernel. This issue may allow a network attacker to decrypt ciphertexts or forge signatures, limiting the services that use that private key...

CVE-2023-6240

CVE-2023-6240 is documented as a Marvin vulnerability side-channel leakage in the Linux kernel RSA decryption operation. The connected Nessus entries confirm this CVE is listed among multiple advisories, referencing the same vulnerability block and associating it with Linux Kernel RSA decryption ...

CVE-2015-10129

CVE-2015-10129 affects planet-freo up to 20150116. A vulnerability exists in admin/inc/auth.inc.php where manipulation of the auth argument leads to an incorrect comparison. The attack could be launched remotely; exploit has been disclosed to the public. The patch is identified as 6ad38c58a45642e...

Design/Logic Flaw

IBM PowerVM Hypervisor FW950.00 through FW950.90, FW1020.00 through FW1020.40, and FW1030.00 through FW1030.30 could reveal sensitive partition data to a system administrator. IBM X-Force ID: 257135...

CVE-2023-33851

CVE-2023-33851 affects IBM PowerVM Hypervisor information disclosure. Vulnerable firmware versions: FW950.00–FW950.90, FW1020.00–FW1020.40, FW1030.00–FW1030.30. Issue: could reveal sensitive partition data to a system administrator. Remediation: upgrade to FW950.A0 (950_145) or newer; FW1020.50 (...

CVE-2023-50947

IBM Business Automation Workflow (BBWA) is affected by CVE-2023-50947, a cross-site scripting vulnerability in the Web UI. The NVD/IBM sources indicate affected versions are 22.0.2, 23.0.1, and 23.0.2, with the issue allowing embedding of arbitrary JavaScript in the Web UI and potentially exposin...

CVE-2021-46902

The CVE-2021-46902 entry applies to Meinberg LANTIME-Firmware LTOS-Web-Interface. The vulnerability concerns path validation in LTOS-Web-Interface, allowing an administrator to read or delete files in violation of access controls. Affected versions are Meinberg LANTIME-Firmware before 6.24.029 MB...

CVE-2020-36773

Summary: CVE-2020-36773 affects Artifex Ghostscript up to version 9.52.x (before 9.53.0). The flaw is an out-of-bounds write and use‑after‑free in devices/vector/gdevtxtw.c (txtwrite) caused by a single PDF character code mapping to multiple Unicode code points (e.g., ligatures). Impact (per sour...

CVE-2023-52425

CVE-2023-52425 affects libexpat up to version 2.5.0, causing a denial of service via resource exhaustion when parsing a very large token that requires multiple buffer fills and reparsing from the start. Connected advisories confirm the issue in expat and note public fixes in newer releases (e.g.,...

CVE-2024-25062

CVE-2024-25062 : Affects libxml2 prior to 2.11.7 and 2.12.x prior to 2.12.5. When using the XML Reader with DTD validation and XInclude expansion, crafted XML can trigger an xmlValidatePopElement use-after-free, as described in multiple connected sources. Impact is described as an availability co...

Design/Logic Flaw

curl inadvertently kept the SSL session ID for connections in its cache even when the verify status OCSP stapling test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check...

Improper access control

Incorrect access control in Reprise License Management Software Reprise License Manager v15.1 allows attackers to arbitrarily save sensitive files in insecure locations via a crafted POST request...