CVE-2024-25677

In Min before 1.31.0, local files are not correctly treated as unique security origins, which allows them to improperly request cross-origin resources. For example, a local file may request other local files through an XML document...

CVE-2024-25677

In Min before 1.31.0, local files are not correctly treated as unique security origins, which allows them to improperly request cross-origin resources. For example, a local file may request other local files through an XML document...

EulerOS 2.0 SP5 : libX11 (EulerOS-SA-2024-1150)

According to the versions of the libX11 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in libX11 due to a boundary condition within the XkbReadKeySyms function. This flaw allows a local user to trigger an...

EulerOS 2.0 SP9 : libXpm (EulerOS-SA-2024-1200)

According to the versions of the libXpm package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in libX11 due to an infinite loop within the PutSubImage function. This flaw allows a local user to consume all availab...

CVE-2024-20290

A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to an incorrect check for end-of-string values during scanning, which may result in a heap buffer...

Regular Expression Denial Of Service (ReDoS)

python-multipart is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to a Regular Expression with inefficient complexity utilized to parse the HTTP Content-Type header. An attacker can send a request with a crafted Content-Type option that consumes excessive CPU...

Denial Of Service (DoS)

github.com/tendermint/tendermint is vulnerable to Denial Of Service DoS. The vulnerability is due to the makeHTTPClient function within httpclient.go automatically decompressing Gzip-compressed responses, without limitations on the size or content of the response body. This allows an attacker to...

CVE-2023-52426

A flaw was found in Expat libexpat. If XMLDTD is undefined at compile time, a recursive XML Entity Expansion condition can be triggered. This issue may lead to a condition where data is expanded exponentially, which will quickly consume system resources and cause a denial of service. Mitigation...

TP-Link ER7206 Omada Gigabit VPN Router uhttpd freeStrategy Command injection Vulnerability

Talos Vulnerability Report TALOS-2023-1850 TP-Link ER7206 Omada Gigabit VPN Router uhttpd freeStrategy Command injection Vulnerability February 6, 2024 CVE Number CVE-2023-43482 SUMMARY A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VP...

Duplicate Advisory: Starlette Content-Type Header ReDoS

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2jv5-9r88-3w3p. This link is maintained to preserve external references. Original Description Summary When using form data, python-multipart uses a Regular Expression to parse the HTTP Content-Type header,...

CVE-2024-24762

python-multipart is a streaming multipart parser for Python. When using form data, python-multipart uses a Regular Expression to parse the HTTP Content-Type header, including options. An attacker could send a custom-made Content-Type option that is very difficult for the RegEx to process, consumi...

CVE-2024-24762

python-multipart is a streaming multipart parser for Python. When using form data, python-multipart uses a Regular Expression to parse the HTTP Content-Type header, including options. An attacker could send a custom-made Content-Type option that is very difficult for the RegEx to process, consumi...

CVE-2024-24762 python-multipart vulnerable to content-type header Regular expression Denial of Service

python-multipart is a streaming multipart parser for Python. When using form data, python-multipart uses a Regular Expression to parse the HTTP Content-Type header, including options. An attacker could send a custom-made Content-Type option that is very difficult for the RegEx to process, consumi...

IBM Security Access Manager XML External Entity Injection Vulnerability

IBM Security Access Manager is a product for information security management applications from International Business Machines IBM. The product enables access management control through integrated appliances for web, mobile and cloud computing. An XML external entity injection vulnerability exist...

The vulnerability of the Rapid SCADA system, related to the improper assignment of permissions for critical resources, allows a intruder to increase their privileges.

The vulnerability of the SCADA system Rapid SCADA is related to the incorrect assignment of permissions for critical resources. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2023-32327

IBM Security Access Manager Container IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this...

Xxe

IBM Security Access Manager Container IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this...

CVE-2023-32327 IBM Security Access Manager Container XML external entity injection

IBM Security Access Manager Container IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this...

CVE-2023-32327

CVE-2023-32327 affects IBM Security Verify Access (Docker 10.0.0.0–10.0.6.1 and Appliance 10.0.0.0–10.0.6.1). Root cause: XML External Entity (XXE) processing in XML data handling. Impact: remote attacker could expose sensitive information or cause memory/resource consumption. Remediation: for ap...

IBM Security Access Manager Container Resource Management Error Vulnerability

IBM Security Access Manager Container is a containerized identity and access management solution from International Business Machines IBM. IBM Security Access Manager Container suffers from a Resource Management Error vulnerability that originates from uncontrolled resource consumption and could...