The vulnerability of the Mbed TLS software lies in errors during encryption processing in DTLS connections, allowing attackers to execute arbitrary code.

The vulnerability of the Mbed TLS software is related to errors in encryption processing in DTLS connections when using zero-key encryption or RC4 encryption. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2023-41765

Layer 2 Tunneling Protocol Remote Code Execution Vulnerability...

CVE-2023-36578

Microsoft Message Queuing MSMQ Remote Code Execution Vulnerability...

GHSA-GJJR-63X4-V8CQ langchain_experimental vulnerable to arbitrary code execution via PALChain in the python exec method

langchainexperimental aka LangChain Experimental in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via import in Python code, which is not prohibited by palchain/base.py...

CVE-2023-4102

QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application...

CVE-2023-40418

An authentication issue was addressed with improved state management. This issue is fixed in watchOS 10. An Apple Watch Ultra may not lock when using the Depth app...

GHSA-G6PH-X5WF-G337 plexus-codehaus vulnerable to directory traversal

A flaw was found in plexus-codehaus. A directory traversal attack also known as path traversal aims to access files and directories stored outside the intended folder. By manipulating files with dot-dot-slash ../ sequences and their variations or by using absolute file paths, it may be possible t...

BELL-CVE-2022-24808 CVE-2022-24808 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2019-3859 CVE-2019-3859 does not affect BellSoft software

Bulletin has no description...

CVE-2023-36787

Microsoft Edge Chromium-based Elevation of Privilege Vulnerability...

OpenZeppelin Contracts vulnerable to Improper Escaping of Output

Impact OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using ERC2771Context along with a custom trusted forwarder may see msgSender return address0 in calls that originate from the forwarder with calldata...

USN-6239-1 ecdsautils vulnerability

It was discovered that ECDSA Util did not properly verify certain signature values. An attacker could possibly use this issue to bypass signature verification...

The vulnerability of the AuthenticodeDeformatter class in the Mono application development platform allows attackers to perform spoofing attacks.

The vulnerability of the AuthenticodeDeformatter class in the Mono application development platform is related to errors in the user interface’s information representation during the loading of the Mono.Security.dll library. Exploiting this vulnerability allows a malicious actor to perform spoofi...

PT-2023-3542 · Mono +1 · Mono +1

Name of the Vulnerable Software and Affected Versions: Mono affected versions not specified Description: The issue is related to errors in presenting information to the user interface when loading the Mono.Security.dll library. It may allow a remote attacker to conduct spoofing attacks...

CVE-2023-26295

Previous versions of HP Device Manager prior to HPDM 5.0.10 could potentially allow command injection and/or elevation of privileges...

OneLogin ruby-saml 命令注入漏洞

Onelogin OneLogin ruby-saml is a Ruby-based SAML Security Assertion Markup Language library for Single Sign-On SSO services from Onelogin, USA. A security vulnerability exists in OneLogin ruby-saml prior to version 1.0.0, which stems from not using pre-defined statements, causing xmlsecurity.rb i...

CLSA-2023-1681327693 nss: Fix of CVE-2023-0767

CVE-2023-0767: nss: improve handling of unknown PKCS12 safe bag types...

CVE-2023-28220

Layer 2 Tunneling Protocol Remote Code Execution Vulnerability...

PYSEC-2023-45

redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connection open after canceling an async Redis command at an inopportune time in the case of a pipeline operation, and can send response data to the client of an unrelated request in an off-by-one manner. The fixed versions fo...

CLSA-2023-1676979221 Update of nss

Update to CKBI 2.60 from NSS 3.86 - Removed: - Certificate "Camerfirma Global Chambersign Root" - Certificate "Cybertrust Global Root" - Certificate "DST Root CA X3" - Certificate "EC-ACC" - Certificate "Explicitly Distrusted DigiNotar PKIoverheid G2" - Certificate "GlobalSign Root CA - R2" -...