483 matches found
GnuTLS Security Vulnerabilities
GnuTLS is a free secure communications library for implementing the SSL, TLS and DTLS protocols. A security vulnerability exists in GnuTLS, which stems from a difference in response time for ciphertexts that are formatted incorrectly versus ciphertexts that are correctly padded, which could allow...
CLSA-2023-1703612912 openssh: Fix of CVE-2023-51385
CVE-2023-51385: ban user/hostnames with most shell metacharacters in command line...
CVE-2023-36004
Windows DPAPI Data Protection Application Programming Interface Spoofing Vulnerability...
PT-2023-7891 · Sap · Sap Btp Security Services Integration Library +1
Name of the Vulnerable Software and Affected Versions: SAP BTP Security Services Integration Library Python sap-xssec versions = 4.1.0 It is recommended to upgrade to the latest released version to ensure the issue is fully resolved. No workarounds are available for this issue...
Validation of SignedInfo
Validation of an XML Signature requires verification that the hash value of the related XML-document after any optional transformations and/or normalizations matches a specific DigestValue-value, but also that the cryptografic signature on the SignedInfo-tree the one that contains the DigestValue...
CVE-2023-42529
Out-of-bound write vulnerability in libsec-ril prior to SMR Nov-2023 Release 1 allows local attackers to execute arbitrary code...
AZL-31303 CVE-2023-45142 affecting package cri-tools for versions less than 1.29.0-2
OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.useragent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP...
CVE-2023-44109
Clone vulnerability in the huks ta module.Successful exploitation of this vulnerability may affect service confidentiality...
The vulnerability of the Mbed TLS software lies in errors during encryption processing in DTLS connections, allowing attackers to execute arbitrary code.
The vulnerability of the Mbed TLS software is related to errors in encryption processing in DTLS connections when using zero-key encryption or RC4 encryption. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2023-41765
Layer 2 Tunneling Protocol Remote Code Execution Vulnerability...
CVE-2023-36578
Microsoft Message Queuing MSMQ Remote Code Execution Vulnerability...
GHSA-GJJR-63X4-V8CQ langchain_experimental vulnerable to arbitrary code execution via PALChain in the python exec method
langchainexperimental aka LangChain Experimental in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via import in Python code, which is not prohibited by palchain/base.py...
CVE-2023-4102
QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application...
CVE-2023-40418
An authentication issue was addressed with improved state management. This issue is fixed in watchOS 10. An Apple Watch Ultra may not lock when using the Depth app...
GHSA-G6PH-X5WF-G337 plexus-codehaus vulnerable to directory traversal
A flaw was found in plexus-codehaus. A directory traversal attack also known as path traversal aims to access files and directories stored outside the intended folder. By manipulating files with dot-dot-slash ../ sequences and their variations or by using absolute file paths, it may be possible t...
BELL-CVE-2022-24808 CVE-2022-24808 does not affect BellSoft software
Bulletin has no description...
BELL-CVE-2019-3859 CVE-2019-3859 does not affect BellSoft software
Bulletin has no description...
CVE-2023-36787
Microsoft Edge Chromium-based Elevation of Privilege Vulnerability...
OpenZeppelin Contracts vulnerable to Improper Escaping of Output
Impact OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using ERC2771Context along with a custom trusted forwarder may see msgSender return address0 in calls that originate from the forwarder with calldata...