CVE-2021-32627: Integer Overflow or Wraparound

Redis is an open source, in-memory database that persists on disk. In affected versions an integer overflow bug in Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves changing the default proto-max-bulk-len and...

CVE-2021-41099: Integer Overflow or Wraparound

Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the underlying string library can be used to corrupt the heap and potentially result with denial of service or remote code execution. The vulnerability involves changing the default proto-max-bulk-len...

PT-2021-4407

Name of the Vulnerable Software and Affected Versions Redis versions prior to 5.0.14 Redis versions prior to 6.0.16 Redis versions prior to 6.2.6 Description The issue is related to an integer overflow bug in Redis that can be exploited to corrupt the heap and potentially trigger remote code...

CVE-2021-32687: Integer Overflow or Wraparound

Redis is an open source, in-memory database that persists on disk. An integer overflow bug affecting all versions of Redis can be exploited to corrupt the heap and potentially be used to leak arbitrary contents of the heap or trigger remote code execution. The vulnerability involves changing the...

PT-2024-11414

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.15.0-rc3-syzkaller Description A NULL pointer dereference vulnerability was found in the Linux kernel's net sched component, specifically in the fifo set limit function. This issue can be triggered by replacing...

CVE-2021-41558

The setuser extension module before 3.0.0 for PostgreSQL allows ProcessUtilityhook bypass via setconfig...

CVE-2021-24634

The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properties of the Recipe Card Block such as ingredientsLayout, iconSet, steps, ingredients, recipeTitle, or settings, which could allow users with a role as low as contributor to perfor...

PT-2021-23332

Name of the Vulnerable Software and Affected Versions set user extension module versions prior to 3.0.0 for PostgreSQL Description The issue allows ProcessUtility hook bypass via set config. Recommendations For versions prior to 3.0.0, update to version 3.0.0 or later to resolve the issue...

Cross-Site Request Forgery (CSRF) in collectiveaccess/providence

Description I have found more endpoints which allow edit/duplicate were not protected from CSRF, the following endpoints are: 1: Edit Global Value in Pawtucket. 2: Change object type. 3: Duplicate object. 4: Duplicate items in the set and add to another set. Proof of Concept Via GET requests: 1...

GHSA-VRXP-MG9F-HWF3 Improperly Implemented path matching for in-toto-golang

Impact Authenticated attackers posing as functionaries i.e., within a trusted set of users for a layout are able to create attestations that may bypass DISALLOW rules in the same layout. An attacker with access to trusted private keys, may issue an attestation that contains a disallowed artifact ...

UBUNTU-CVE-2021-39584

An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function namespacesethash located in pool.c. It allows an attacker to cause Denial of Service...

CVE-2021-39584

An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function namespacesethash located in pool.c. It allows an attacker to cause Denial of Service...

PT-2021-22656

Name of the Vulnerable Software and Affected Versions: swftools versions through 20200710 Description: An issue exists in the function namespace set hash located in pool.c, which allows an attacker to cause Denial of Service due to a NULL pointer dereference. Recommendations: For versions through...

Linux xdr_set_page_base Buffer Overflow DoS

The vulnerability of the xdrsetpagebase function in the net/sunrpc/xdr.c component of the Linux operating system is related to operations that go beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to cause a service failure through a large number o...

PT-2024-11365

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the irq set affinity hit function, which stores a reference to the cpumask t parameter in the irq descriptor. This reference can be accessed later from irq affini...

CVE-2021-23440

A type confusion vulnerability in nodejs-set-value can lead to a bypass of CVE-2019-10747. If the user-provided keys used in the path parameter are arrays, the function mixin-deep can be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or...

poco:json_parser_fuzzer: Use-of-uninitialized-value in Poco::JSON::Object::set

Project: https://github.com/pocoproject/poco.git Detailed Report: https://oss-fuzz.com/testcase?key=4945193921544192 Project: poco Fuzzing Engine: libFuzzer Fuzz Target: jsonparserfuzzer Job Type: libfuzzermsanpoco Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel has a security vulnerability that can be exploited by an attacker to run code through the MIPS CBPF JIT compiler branch instruction...

The function addToken does not check if the token was already added

Handle hrkrshnn Vulnerability details addToken does not check if the token was already added The function addToken does not check if the token was already present. function addToken address vault, address token external override notHalted onlyStrategist requireallowedTokenstoken, "!allowedTokens"...

PT-2024-11375

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.18.0-147 Description A use-after-free vulnerability has been resolved in the Linux kernel. The issue occurred in the blk-cgroup component, where a use-after-free report was generated by KASAN during a fuzz test...