VulnCheck KEV: CVE-2023-31290

Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input...

AZL-13606 CVE-2023-0475 affecting package terraform for versions less than 1.3.2-22

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0...

SUSE CVE-2006-2418

Cross-site scripting XSS vulnerabilities in certain versions of phpMyAdmin before 2.8.0.4 allow remote attackers to inject arbitrary web script or HTML via the db parameter in unknown scripts...

SUSE CVE-2006-6772

Format string vulnerability in the inputAnswer function in file.c in w3m before 0.5.2, when run with the dump or backend option, allows remote attackers to execute arbitrary code via format string specifiers in the Common Name CN field of an SSL certificate associated with an https URL...

SUSE CVE-2010-4666

Buffer overflow in libarchive 3.0 pre-release code allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted CAB file, which is not properly handled during the reading of Huffman code data within LZX compressed data...

SUSE CVE-2011-3084

Google Chrome before 19.0.1084.46 does not use a dedicated process for the loading of links found on an internal page, which might allow attackers to bypass intended sandbox restrictions via a crafted page...

SUSE CVE-2012-6054

The dissectsflow245addresstype function in epan/dissectors/packet-sflow.c in the sFlow dissector in Wireshark 1.8.x before 1.8.4 does not properly handle length calculations for an invalid IP address type, which allows remote attackers to cause a denial of service infinite loop via a packet that ...

SUSE CVE-2013-1982

Multiple integer overflows in X.org libXext 1.3.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the 1 XcupGetReservedColormapEntries, 2 XcupStoreColors, 3 XdbeGetVisualInfo, 4 XeviGetVisualInfo, 5 XShapeGetRectangles, and 6...

SUSE CVE-2016-1901

Integer overflow in the authenticatepost function in CGit before 0.12 allows remote attackers to have unspecified impact via a large value in the Content-Length HTTP header, which triggers a buffer overflow...

SUSE CVE-2016-5098

Directory traversal vulnerability in libraries/errorreport.lib.php in phpMyAdmin before 4.6.2-prerelease allows remote attackers to determine the existence of arbitrary files by triggering an error...

SUSE CVE-2016-9311

ntpd in NTP before 4.2.8p9, when the trap service is enabled, allows remote attackers to cause a denial of service NULL pointer dereference and crash via a crafted packet...

SUSE CVE-2020-36332

A flaw was found in libwebp in versions before 1.0.1. When reading a file libwebp allocates an excessive amount of memory. The highest threat from this vulnerability is to the service availability...

SUSE CVE-2021-25316

A Insecure Temporary File vulnerability in s390-tools of SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-SP2 allows local attackers to prevent VM live migrations This issue affects: SUSE Linux Enterprise Server 12-SP5 s390-tools versions prior to 2.1.0-18.29.1. SUSE Linux...

bumsys 代码问题漏洞

bumsys is an open source project called Business Management System by unilogies individual developers. A code issue vulnerability exists in versions prior to bumsys v1.0.3-beta, which stems from the fact that it allows an attacker to upload dangerous types of files without restriction...

java-1.8.0-openjdk security and bug fix update

1.8.0.362.b09-2.0.1 - Replace upstream references Orabug: 34340145 1:1.8.0.362.b09-2 - Update cacerts patch to fix OPENJDK-1433 SecurityManager issue - Update to shenandoah-jdk8u352-b09 GA - Update release notes for shenandoah-8u352-b09. - Resolves: rhbz2163594 1:1.8.0.362.b08-2 - Update to...

java-11-openjdk security and bug fix update

11.0.18.0.10-2.0.1 - Replace upstream references Orabug: 34340155 1:11.0.18.0.10-2 - Update to jdk-11.0.18+10 GA - Update release notes to 11.0.18+10 - Switch to GA mode for release - This tarball is embargoed until 2023-01-17 @ 1pm PT. - Related: rhbz2157798 1:11.0.18.0.9-0.2.ea - Update to...

Froxlor 注入漏洞

Froxlor is a lightweight server management software from the Froxlor team. An injection vulnerability exists in versions prior to Froxlor 2.0.0-beta1, which stems from parameter injection...

memos 访问控制错误漏洞

memos is an open source hosted memo center with knowledge management and social features. An Access Control Error vulnerability exists in memos versions prior to 0.9.1, which can be exploited by an attacker to obtain all files in any user's resources and delete any file of any user via IDOR...

GuardDog 路径遍历漏洞

GuardDog is an open source CLI tool from GuardDog that allows the identification of malicious PyPI packages. A security vulnerability exists in GuardDog versions prior to 0.1.5, which stems from vulnerability to relative path traversal attacks when scanning specially crafted native PyPI packages...

Google Chrome 资源管理错误漏洞

Google Chrome is a web browser from Google, an American company. Google Chrome version 108.0.5359.71 prior to release for use in Mojo has a security vulnerability that can be exploited by an attacker to launch an attack by tricking a user into installing a malicious extension and exploiting heap...