462 matches found
CVE-2024-25282
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...
CVE-2024-25282
Redsys 3DSecure 2.0 (3DS Method Authentication) is reported vulnerable to Cross‑Site Scripting (XSS) via a modified params parameter in a /rest/online request with a /redirect?action=challenge&txn=... path. Root cause: insufficient sanitization/validation of the params field, which is base64-enco...
CVE-2024-25282
3DSecure 2.0 allows XSS in its 3DSMethod Authentication via a modified params parameter in a /rest/online request with a /redirect?action=challenge&txn= substring...
Mass-Assigner - Simple Tool Made To Probe For Mass Assignment Vulnerability Through JSON Field Modification In HTTP Requests
Mass Assigner is a powerful tool designed to identify and exploit mass assignment vulnerabilities in web applications. It achieves this by first retrieving data from a specified request, such as fetching user profile data. Then, it systematically attempts to apply each parameter extracted from th...
CVE-2024-45813
CVE-2024-45813 affects the find-my-way HTTP router. A bad regular expression is generated when two parameters exist within a single segment, notably with a trailing dash (e.g., ":/a-:b-"). This can lead to a Denial of Service in some cases. Affected versions require upgrade to find-my-way v8.2.2 ...
CVE-2024-45813 ReDoS vulnerability in multiparametric routes in find-my-way
find-my-way is a fast, open source HTTP router, internally using a Radix Tree aka compact Prefix Tree, supports route params, wildcards, and it's framework independent. A bad regular expression is generated any time one has two parameters within a single segment, when adding a - at the end, like...
PT-2024-31549
Name of the Vulnerable Software and Affected Versions path-to-regexp versions prior to 0.1.10 path-to-regexp versions prior to 8.0.0 Description The issue arises when path-to-regexp generates a regular expression that can cause poor performance, leading to a Denial of Service DoS. This occurs whe...
CVE-2024-43895
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2024-43895
...
CVE-2024-43895
CVE-2024-43895 relates to the Linux kernel DRM/AMD display path, specifically a NULL pointer dereference when recomputing DSC parameters if no stream is on the link during MST+DSC setup. This can trigger a kernel oops/crash as described in vendor advisories. Connected sources show the issue is ad...
AZL-48197 CVE-2024-43884 affecting package kernel for versions less than 6.6.51.1-5
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Add error handling to pairdevice hciconnparamsadd never checks for a NULL value and could lead to a NULL pointer dereference causing a crash. Fixed by adding error handling in the function...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a potential out-of-bounds access in the dml2calculaterqanddlgparams function due to the index of the...
streamlit-geospatial 安全漏洞
streamlit-geospatial is an Open Geospatial Solutions open source streamlit multi-page application for geospatial applications. A security vulnerability exists in streamlit-geospatial, which originates in pages/1? The visparams variable in Timelapse.py accepts user input that is then used in the...
CVE-2023-52291
CVE-2023-52291 concerns Apache StreamPark. The vulnerability stems from lax validation of maven build parameters in the StreamPark project module, allowing command injection when the input parameter < is used (for example, < (curl http://xxx.com)). An attack requires the user to be logged i...
Path Traversal
@jmondi/url-to-png is vulnerable to Path Traversal. The vulnerability is due to the lack of proper sanitization or validation of the ImageId input within extractqueryparams.ts, which allows an attacker to store an image in an arbitrary location that the server has permission to access...
Malicious code in ez-get-url-params (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-2353 Malicious code in ez-get-url-params (npm)
--- -= Per source details. Do not edit below this line.=-...
CVE-2021-47443 NFC: digital: fix possible memory leak in digital_tg_listen_mdaa()
In the Linux kernel, the following vulnerability has been resolved: NFC: digital: fix possible memory leak in digitaltglistenmdaa 'params' is allocated in digitaltglistenmdaa, but not free when digitalsendcmd failed, which will cause memory leak. Fix it by freeing 'params' if digitalsendcmd retur...
DEBIAN-CVE-2023-52866
In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: Fix user-memory-access bug in uclogicparamsugeev2initeventhooks When CONFIGHIDUCLOGIC=y and CONFIGKUNITALLTESTS=y, launch kernel and then the below user-memory-access bug occurs. In...