PrestaShop SQL注入漏洞

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. A SQL injection vulnerability exists in PrestaShop versions 1.4.0 to 1.8.2, which ste...

PT-2023-2671 · Oracle · Oracle E-Business Suite

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.11 Description: The issue is related to insufficient input validation in the GUI component of the Oracle Application Object Library. This can be exploited by a remote attacker to cause a...

UBUNTU-CVE-2021-33797

Buffer-overflow in jsdtoa.c in Artifex MuJS in versions 1.0.1 to 1.1.1. An integer overflow happens when jsstrtod reads in floating point exponent, which leads to a buffer overflow in the pointer d...

Apache IoTDB 授权问题漏洞

Apache IoTDB is an integrated data management engine designed for time series data from the Apache Foundation USA that provides data collection, storage and analysis services, among other things. An authorization issue vulnerability exists in Apache IoTDB Grafana Connector versions 0.13.0 through...

MaxContribution check can be bypassed to give a card high voting power

Lines of code Vulnerability details Proof of Concept ReraiseETHCrowdfund tries limit the voting power of each card by doing a min/maxContribution check in claim and claimMultiple. uint96 contribution = votingPower 1e4 / exchangeRateBps; uint96 maxContribution = maxContribution; // Check that the...

FreeBSD : py-tensorflow -- denial of service vulnerability (ae132c6c-d716-11ed-956f-7054d21a9e2a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ae132c6c-d716-11ed-956f-7054d21a9e2a advisory. - TensorFlow is an open source platform for machine learning. The implementation of...

Zoho ManageEngine Applications Manager 跨站脚本漏洞

ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product features application performance management, fault management, report generation, and SLA management. A security vulnerability exists in Zoho...

Security Bulletin: IBM Informix Dynamic Server is affected when a specific function in the Spatial Datablade is called with an out-of-range parameter

Summary IBM Informix Dynamic Server could crash when a specific function is called with an out-of-range parameter within the Spatial Datablade. A user would need access to the server and the ability to execute arbitrary sql to call this function. If you ARE NOT USING the spatial technology, you c...

apache-commons-text: variable interpolation RCE

A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code...

UBUNTU-CVE-2023-0838

An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342...

PT-2023-16736 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 15.5 through 15.8.4 GitLab versions 15.9 through 15.9.3 GitLab versions 15.10 through 15.10.0 Description: An issue has been discovered in GitLab due to improper permissions checks, allowing an unauthorized user to remove an...

PT-2023-16279 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 8.1 through 15.8.5 GitLab versions 15.9 through 15.9.4 GitLab versions 15.10 through 15.10.1 Description: An issue has been discovered in GitLab where it was possible to add a branch with an ambiguous name, which could be used...

PT-2023-17198 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 11.10 through 15.8.5 GitLab versions 15.9 through 15.9.4 GitLab versions 15.10 through 15.10.1 Description: A denial of service condition exists in the Prometheus server bundled with GitLab. This issue affects various versions...

PT-2023-16330 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 15.6 through 15.8.4 GitLab versions 15.9 through 15.9.3 GitLab versions 15.10 through 15.10.0 Description: An issue has been discovered in GitLab, allowing for a cross-site scripting XSS attack via a malicious email address fo...

AZL-25966 CVE-2023-26916 affecting package libyang for versions less than 2.1.55-1

libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lysparsemem at lysparsemem.c...

NVIDIA GPU Display Driver for Linux 缓冲区错误漏洞

NVIDIA GPU Display Driver for Linux is a driver from NVIDIA Corporation for interactive support of graphics card display modules in Linux systems. A security vulnerability exists in the NVIDIA GPU Display Driver for Linux version, which arises from improperly restricting operations within a memor...

HashiCorp Vault SQL注入漏洞

HashiCorp Vault is a private key access management tool from HashiCorp Inc. in the United States. A SQL injection vulnerability exists in HashiCorp Vault versions 0.8.0 through 1.13.1, which stems from the fact that when configuring the MSSQL plugin locally, certain parameters are not cleaned up...

The vulnerability of software for storing images with a wide dynamic range of brightness, related to pointer swapping errors, allows attackers to trigger a service failure.

The vulnerability of software for storing images with a wide dynamic range of brightness in OpenEXR is related to pointer arithmetic errors. Exploiting this vulnerability can allow an attacker to cause service interruptions...

Mageia: Security Advisory (MGASA-2023-0106)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Buffer overflow

Snappier is a high performance C implementation of the Snappy compression algorithm. This is a buffer overrun vulnerability that can affect any user of Snappier 1.1.0. In this release, much of the code was rewritten to use byte references rather than pointers to pinned buffers. This change...