645765 matches found
EUVD-2023-60623
PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server...
CVE-2023-54394 PocketMine-MP before 4.18.0-ALPHA2 Bandwidth Amplification via InventoryTransactionPacket
PocketMine-MP before 4.18.0-ALPHA2 fails to rate-limit mismatch type InventoryTransactionPacket requests, allowing attackers to trigger excessive inventory synchronization. Attackers can send numerous mismatch transactions to force the server to transmit large amounts of serialized inventory data...
CVE-2023-54393
PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in the LoginPacket JSON parsing logic, caused by improper validation in the JsonMapper dependency. An unauthenticated attacker can send malformed JSON structures within a LoginPacket to crash the server . The CVSS v3.1...
EUVD-2023-60624
PocketMine-MP before 4.18.0-ALPHA2 fails to rate-limit mismatch type InventoryTransactionPacket requests, allowing attackers to trigger excessive inventory synchronization. Attackers can send numerous mismatch transactions to force the server to transmit large amounts of serialized inventory data...
CVE-2023-54393 PocketMine-MP before 4.20.5 Denial of Service via LoginPacket
PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server...
EUVD-2023-60622
PocketMine-MP versions = 4.20.0 before 4.22.3 and before 5.2.1 in the 5.x branch fail to validate NBT tag types in BlockActorDataPacket. A player can crash the server by sending a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that...
CVE-2023-54392
PocketMine-MP versions ≥ 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) fail to validate NBT tag types in the BlockActorDataPacket . An authenticated player can send a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that te...
CVE-2023-54392 PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket
PocketMine-MP versions = 4.20.0 before 4.22.3 and before 5.2.1 in the 5.x branch fail to validate NBT tag types in BlockActorDataPacket. A player can crash the server by sending a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that...
EUVD-2023-60621
PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server...
CVE-2023-54355
PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. An unauthenticated network attacker can supply a LoginPacket with a key on a different curve or a non-EC key type, passing login verification but t...
EUVD-2023-60620
PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exceptio...
CVE-2023-54355 PocketMine-MP 5.2.0 Server Crash via Incorrect EC Curve
PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exceptio...
CVE-2023-54390
PocketMine-MP versions before 5.3.1 and 4.23.1 are vulnerable to a denial of service caused by improper null value handling in arrays during LoginPacket JSON parsing. An unauthenticated, remote attacker can send malformed JSON containing unexpected null elements in the LoginPacket to crash the se...
CVE-2023-54390 PocketMine-MP before 5.3.1 Denial of Service via LoginPacket
PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server...
CVE-2023-54390 PocketMine-MP before 5.3.1 Denial of Service via LoginPacket
PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server...
CVE-2026-79969
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability. An unauthenticated attacker with remote access could potentially explo...
CVE-2026-79968
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Time-of-check Time-of-use TOCTOU Race Condition vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial o...
CVE-2026-79962
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability. An unauthenticated attacker with remote access could potentially explo...
CVE-2026-9198_exploit
CVE-2026-9198 — Langflow OSS 인증 없는 RCE 기본 배포 환경에서 IBM Langflow OSS 1.0.0 – 1.10.0의 인증 없는 원격 코드 실행 취약점입니다. 두 가지 결함을 연쇄적으로 악용합니다: CVE-2026-9103 — AUTOLOGIN이 활성화된 경우Langflow 1.5의 기본값 GET /api/v1/autologin은 자격 증명이 없는 호출자에게도 SUPERUSER JWT를 발급합니다. CVE-2026-8481 — POST /api/v1/validate/code는 사용자가 제공한...
gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write
A flaw was found in GStreamer gst-plugins-good avidemux. When parsing FUJIFILM metadata in an AVI strd chunk, gstavidemuxparsestrd decrements a remaining-length counter by fixed offsets 98 and 10 bytes without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 byte...