OSV-2024-1380 Index-out-of-bounds in ndpi_search_dns

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=383911300 Crash type: Index-out-of-bounds Crash state: ndpisearchdns searchdnsagain ndpidetectionprocesspacket...

OSV-2024-1375 Index-out-of-bounds in dwg_decode_eed

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=383814052 Crash type: Index-out-of-bounds Crash state: dwgdecodeeed dwgdecodeentity dwgdecodeRAYprivate...

OSV-2024-1372 Bad-cast to Assimp::LogStream from Assimp::OptimizeMeshesProcess

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=383595860 Crash type: Bad-cast Crash state: Bad-cast to Assimp::LogStream from Assimp::OptimizeMeshesProcess CallbackToLogRedirector Assimp::DefaultLogger::WriteToStreams...

OSV-2024-1356 Heap-buffer-overflow in ChunkAssignData

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=382816119 Crash type: Heap-buffer-overflow READ 1 Crash state: ChunkAssignData WebPMuxCreateInternal MuxDemuxApiTest...

OSV-2024-1355 UNKNOWN READ in glslang::TInfoSinkBase::location

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=382922237 Crash type: UNKNOWN READ Crash state: glslang::TInfoSinkBase::location glslang::TParseContextBase::outputMessage glslang::TParseContextBase::error...

OSV-2024-1351 Use-of-uninitialized-value in Archive::UnexpEndArcMsg

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=382526743 Crash type: Use-of-uninitialized-value Crash state: Archive::UnexpEndArcMsg Archive::ReadHeader50 Archive::ReadHeader...

OSV-2024-1348 Heap-buffer-overflow in glslang::HlslGrammar::acceptDeclaration

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=382721848 Crash type: Heap-buffer-overflow READ 1 Crash state: glslang::HlslGrammar::acceptDeclaration glslang::HlslGrammar::acceptCompilationUnit glslang::HlslParseContext::parseShaderStrings...

OSV-2024-1346 UNKNOWN READ in glslang::HlslTokenStream::advanceToken

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=382547706 Crash type: UNKNOWN READ Crash state: glslang::HlslTokenStream::advanceToken glslang::HlslGrammar::acceptLiteral glslang::HlslGrammar::acceptPostfixExpression...

OSV-2024-1336 Security exception in org.checkerframework.checker.formatter.util.FormatUtil.formatParameterCategories

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=380409697 Crash type: Security exception Crash state: org.checkerframework.checker.formatter.util.FormatUtil.formatParameterCategories UtilCheckerFuzzer.fuzzChecker UtilCheckerFuzzer.fuzzerTestOneInput...

Google's AI-Powered OSS-Fuzz Tool Finds 26 Vulnerabilities in Open-Source Projects

Google has revealed that its AI-powered fuzzing tool, OSS-Fuzz, has been used to help identify 26 vulnerabilities in various open-source code repositories, including a medium-severity flaw in the OpenSSL cryptographic library. "These particular vulnerabilities represent a milestone for automated...

OSV-2024-1332 Negative-size-param in extract_mr_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=379768247 Crash type: Negative-size-param Crash state: extractmrdata parsemrstring readstatparsesav...

CVE-2024-30896

InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default organization to retrieve the operator token. InfluxDB OSS 1.x, Enterprise, Cloud, Cloud Dedicated and...

Grafana Labs Privilege Escalation (CVE-2024-9476)

The version of Grafana Labs installed on the remote host is affected by a vulnerability as referenced in the CVE-2024-9476 advisory. - A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within th...

OSV-2024-1326 Heap-buffer-overflow in ndpi_search_mikrotik

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=379180960 Crash type: Heap-buffer-overflow READ 16 Crash state: ndpisearchmikrotik checkndpidetectionfunc ndpidetectionprocesspacket...

OSV-2024-1322 Security exception in com.alibaba.fastjson2.JSONReader.readObject

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=379180973 Crash type: Security exception Crash state: com.alibaba.fastjson2.JSONReader.readObject java.base/java.nio.charset.CharsetEncoder.replaceWith java.base/java.nio.charset.CharsetEncoder...

OSV-2024-1320 Heap-buffer-overflow in process_page_

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=379254072 Crash type: Heap-buffer-overflow READ 4 Crash state: processpage FLACoggdecoderaspectskiplink FLACstreamdecoderseekabsolute...

OSV-2024-1313 Security exception in org.apache.commons.codec.language.bm.Rule$Phoneme.<init>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=379008019 Crash type: Security exception Crash state: org.apache.commons.codec.language.bm.Rule$Phoneme. org.apache.commons.codec.language.bm.Rule$Phoneme. org.apache.commons.codec.language.bm.PhoneticEngine$PhonemeBuilder.app...

CVE-2024-5082 Nexus Repository 2 - Remote Code Execution

A Remote Code Execution vulnerability has been discovered in Sonatype Nexus Repository 2. This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1...

MAL-2024-10674 Malicious code in listing-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9721f8e927e787ea57b202a8a5b29ab1fd0cd530861055ad6a3e36a1c0df8d9a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OSV-2024-1297 Heap-buffer-overflow in rijndaelSetupEncrypt

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=377977949 Crash type: Heap-buffer-overflow READ 1 Crash state: rijndaelSetupEncrypt rijndaelSetupDecrypt AESPDFnative::AESPDFnative...