CVE-2024-3854

This vulnerability exists in Firefox (versions < 125, ESR < 115.10) and Thunderbird (versions

CVE-2024-2083 Directory Traversal in zenml-io/zenml

A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit this vulnerability by manipulating the 'logs' URI path in the request to fetch arbitrary file content, bypassing intended access restrictions. The...

Vite 安全漏洞

Vite is a new front-end builder tool open-sourced by Vite. A security vulnerability exists in Vite that stems from server.fs.deny not rejecting requests with directory patterns. Affected products and versions: Vite versions 2.7.0 through 2.9.17, 3.0.0 through 3.2.8, 4.0.0 through 4.5.2, 5.0.0...

GHSA-8JHW-289H-JH2G Vite's `server.fs.deny` did not deny requests for patterns with directories.

Summary Vite dev server option server.fs.deny did not deny requests for patterns with directories. An example of such a pattern is /foo//. Impact Only apps setting a custom server.fs.deny that includes a pattern with directories, and explicitly exposing the Vite dev server to the network using...

Authentication Check Pattern Found in Unauthenticated Browser

This is an informational notice that the scanner was able to find the authentication check pattern using an unauthenticated browser. This indicates that the scanner cannot validate if authentication was successful. No source data...

golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads

A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.goL113. The objects leaked are pkey​ and ctx​. That functi...

Apache Camel Deserialization Vulnerability

Apache Camel is the United States Apache Apache Foundation of a set of open source based on Enterprise Integration Pattern Enterprise Integration Pattern , referred to as EIP integration framework. The framework provides Enterprise Integration Pattern Java objects POJO implementation , and throug...

BIT-GITLAB-2021-39938

A vulnerable regular expression pattern in GitLab CE/EE since version 8.15 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to cause uncontrolled resource consumption leading to Denial of Service via specially crafted...

BIT-SOLR-2023-50291 Apache Solr: System Property redaction logic inconsistency can lead to leaked passwords

Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties...

CentOS 9 : cpio-2.13-16.el9

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the cpio-2.13-16.el9 build changelog. - GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c dsfgetstr integer overflow that...

Regular Expression Denial Of Service (ReDoS)

rack is vulnerable to a Denial Of Service. This vulnerability is due the handling of content type parsing which utilizes a regex pattern with inefficient complexity, which allows attackers to launch DoS attacks...

Imaging Data Commons libdicom DICOM File Meta Information Parsing Use-After-Free vulnerabilities

Talos Vulnerability Report TALOS-2024-1931 Imaging Data Commons libdicom DICOM File Meta Information Parsing Use-After-Free vulnerabilities February 20, 2024 CVE Number CVE-2024-24793,CVE-2024-24794 SUMMARY A use-after-free vulnerability exists in the DICOM Element Parsing as implemented in Imagi...

CVE-2024-21771

For unspecified traffic patterns, BIG-IP AFM IPS engine may spend an excessive amount of time matching the traffic against signatures, resulting in Traffic Management Microkernel TMM restarting and traffic disruption. Note: Software versions which have reached End of Technical Support EoTS are no...

Cross site scripting

Cross-site Scripting in the tag name pattern field in the tag protections UI in GitHub Enterprise Server allows a malicious website that requires user interaction and social engineering to make changes to a user account via CSP bypass with created CSRF tokens. This vulnerability affected all...

ISC BIND Security Vulnerability

ISC BIND is a suite of open source software that implements the DNS protocol from the US company ISC. A security vulnerability exists in ISC BIND that stems from a specific recursive query pattern that may result in out of memory...

CVE-2024-1084: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting in the tag name pattern field in the tag protections UI in GitHub Enterprise Server allows a malicious website that requires user interaction and social engineering to make changes to a user account via CSP bypass with created CSRF tokens. This vulnerability affected all...

icu:date_time_pattern_generator_fuzzer: Stack-buffer-overflow in icu_75::StringPiece::StringPiece

Project: https://github.com/unicode-org/icu.git Detailed Report: https://oss-fuzz.com/testcase?key=5596466030641152 Project: icu Fuzzing Engine: libFuzzer Fuzz Target: datetimepatterngeneratorfuzzer Job Type: libfuzzerasanicu Platform Id: linux Crash Type: Stack-buffer-overflow READ 10 Crash...

http-pattern-matcher:http_template_fuzz_test: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6624741750276096 Project: http-pattern-matcher Fuzzing Engine: libFuzzer Fuzz Target: httptemplatefuzztest Job Type: libfuzzerasanhttp-pattern-matcher Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x588ff322bd85 Crash State: NULL...

http-pattern-matcher:http_template_fuzz_test: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6624741750276096 Project: http-pattern-matcher Fuzzing Engine: libFuzzer Fuzz Target: httptemplatefuzztest Job Type: libfuzzerasanhttp-pattern-matcher Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x588ff322bd85 Crash State: NULL...

http-pattern-matcher:http_template_fuzz_test: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6624741750276096 Project: http-pattern-matcher Fuzzing Engine: libFuzzer Fuzz Target: httptemplatefuzztest Job Type: libfuzzerasanhttp-pattern-matcher Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x588ff322bd85 Crash State: NULL...