4722 matches found
CVE-2023-1836
A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. When viewing an XML file in a repository in "raw" mode, it can be made to render as...
CVE-2023-1836: Improper Neutralization of Input During Web Page Generation
A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. When viewing an XML file in a repository in "raw" mode, it can be made to render as...
GitLab cross-site scripting vulnerabilities
GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab, which stems from a special method...
PT-2023-17270 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions 5.1 through 15.9.5 GitLab versions 15.10 through 15.10.4 GitLab versions 15.11 through 15.11.0 Description: A cross-site scripting issue has been discovered in GitLab. When viewing an XML file in a repository in "raw" mode, it...
Vtech VCS754 security vulnerability
The Vtech VCS754 is a conference phone from Vtech Hong Kong, China. A security vulnerability exists in the Vtech VCS754 version 1.1.1.A to versions prior to 1.1.1.H, which originates from passing a plaintext password in raw HTML. An attacker could exploit the vulnerability to escalate privileges...
PT-2023-9001 · Vmware · Vmware Fusion
Name of the Vulnerable Software and Affected Versions: VMware Fusion affected versions not specified Description: The issue is related to a local privilege escalation, where a malicious actor with read/write access to the host operating system can gain root access. This is due to insecure privile...
GHSA-W9G2-3W7P-72G9 Incorrect success value returned in vyper
Background During the audit of Lido's Gate Seals code statemind team identified a weird behavior of the code that uses rawcall: https://github.com/lidofinance/gate-seals/blob/051593e74df01a4131c485b4fda52e691cd4b7d8/contracts/GateSeal.vyL164 . Construction like this: vyper success = rawcall...
PYSEC-2023-131
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates the wrong bytecode. Any contract that uses the rawcall with revertonfailure=False and maxoutsize=0 receives the wrong response from rawcall. Depending on the...
CVE-2023-30629 Vyper's raw_call with outsize=0 and revert_on_failure=False returns incorrect success value
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates the wrong bytecode. Any contract that uses the rawcall with revertonfailure=False and maxoutsize=0 receives the wrong response from rawcall. Depending on the...
PT-2023-22826 · Vyper · Vyper
Name of the Vulnerable Software and Affected Versions: Vyper versions 0.3.1 through 0.3.7 Description: The Vyper compiler generates the wrong bytecode in versions 0.3.1 through 0.3.7. Any contract that uses the raw call with revert on failure=False and max outsize=0 receives the wrong response fr...
RAW image plugin Code Execution
The vulnerability of the plugin for viewing RAW images is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code...
RAW image plugin Code Execution
The vulnerability of the plugin for viewing RAW images is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code...
libraw:libraw_fuzzer: Crash in LibRaw_buffer_datastream::read
Project: https://github.com/libraw/libraw.git Detailed Report: https://oss-fuzz.com/testcase?key=5214991459680256 Project: libraw Fuzzing Engine: libFuzzer Fuzz Target: librawfuzzer Job Type: libfuzzerasanlibraw Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x76eec232ff60 Crash Stat...
CVE-2023-29207 Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro
XWiki Commons are technical libraries common to several other top level XWiki projects. The Livetable Macro wasn't properly sanitizing column names, thus allowing the insertion of raw HTML code including JavaScript. This vulnerability was also exploitable via the Documents Macro that is included...
XWiki Commons Cross-Site Scripting Vulnerabilities
XWiki Commons is a technology library shared by several other top XWiki projects. A cross-site scripting vulnerability exists in XWiki Commons, which stems from Livetable Macro not properly cleaning up column names, thus allowing the insertion of raw HTML code including JavaScript...
CVE-2022-33259
Memory corruption due to buffer copy without checking the size of input in modem while decoding raw SMS received...
PT-2023-35769
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN READ. The crash state involves functions such as page size, dns packet new, and dns resource record new fro...
CVE-2023-28291
Raw Image Extension Remote Code Execution Vulnerability...