6431 matches found
OSV-2023-404 Invalid-free in Assimp::FBX::Scope::Scope
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59056 Crash type: Invalid-free Crash state: Assimp::FBX::Scope::Scope Assimp::FBX::Element::Element Assimp::FBX::Scope::Scope...
PT-2023-35831 · Assimp · Assimp
Name of the Vulnerable Software and Affected Versions: Assimp affected versions not specified Description: The issue is related to an Invalid-free crash type. It involves the Assimp::FBX::Scope::Scope and Assimp::FBX::Element::Element functions. No information is provided about the estimated numb...
UBUNTU-CVE-2023-31629
An issue in the sqlounionscope component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service DoS via crafted SQL statements...
Virtuoso Open-Source Edition SQL注入漏洞
Virtuoso Open-Source Edition is a high-performance and scalable multi-model RDBMS, data integration middleware, linked data deployment, and HTTP application server platform open-sourced by OpenLink Software. A security vulnerability exists in Virtuoso Open-Source Edition version v7.2.9, which...
PT-2023-2708 · Microsoft · Windows
Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to insecure privilege management in the Windows operating system kernel. It allows an attacker to elevate their privileges. There is no information provided about the...
Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs
Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the mlflow server or mlflow ui commands using an MLflow version older than MLflow 2.3.1 may be vulnerable to a remote file access exploit if they are not limiting who can query their server for example,...
CVE-2023-25506
NVIDIA DGX-1 contains a vulnerability in Ofbd in AMI SBIOS, where a preconditioned heap can allow a user with elevated privileges to cause an access beyond the end of a buffer, which may lead to code execution, escalation of privileges, denial of service and information disclosure. The scope of t...
Code injection via unescaped translations in xwiki-platform
Impact In XWiki, every user can add translations that are only applied to the current user. This also allows overriding existing translations. Such translations are often included in privileged contexts without any escaping which allows remote code execution for any user who has edit access on at...
GHSA-4V38-964C-XJMW Code injection via unescaped translations in xwiki-platform
Impact In XWiki, every user can add translations that are only applied to the current user. This also allows overriding existing translations. Such translations are often included in privileged contexts without any escaping which allows remote code execution for any user who has edit access on at...
Design/Logic Flaw
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In XWiki, every user can add translations that are only applied to the current user. This also allows overriding existing translations. Such translations are often included in privileged...
CVE-2023-29510 Code injection via unescaped translations in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In XWiki, every user can add translations that are only applied to the current user. This also allows overriding existing translations. Such translations are often included in privileged...
CVE-2023-29510: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In XWiki, every user can add translations that are only applied to the current user. This also allows overriding existing translations. Such translations are often included in privileged...
CVE-2023-21956: Undefined Security Weakness
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Web Container. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic...
gatsby 路径遍历漏洞
gatsby is a software application. A free open source framework based on React that helps developers build extremely fast websites and applications. A path traversal vulnerability exists in gatsby, which stems from the presence of a path traversal vulnerability that can be exploited by an attacker...
DEBIAN-CVE-2020-17354
LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated by dangerous Scheme code in a .ly file that causes arbitrary code execution during conversion to a different file format. NOTE: in 2.24 and later versions, sa...
PT-2023-11479
Name of the Vulnerable Software and Affected Versions LilyPond versions prior to 2.24 Description The issue allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated by dangerous Scheme code in a .ly file that causes arbitrary code...
CVE-2020-17354: Incorrect Authorization
LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated by dangerous Scheme code in a .ly file that causes arbitrary code execution during conversion to a different file format. NOTE: in 2.24 and later versions, sa...
CVE-2020-17354
LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated by dangerous Scheme code in a .ly file that causes arbitrary code execution during conversion to a different file format. NOTE: in 2.24 and later versions, sa...
PT-2023-9506 · Openlink +4 · Openlink Virtuoso-Opensource +4
Name of the Vulnerable Software and Affected Versions: openlink virtuoso-opensource version 7.2.9 Description: The issue in the sqlo union scope component of openlink virtuoso-opensource is related to the improper neutralization of special elements used in SQL commands, allowing attackers to caus...