11833 matches found
TLS 1.3 client issue handling malicious server when not including a KSE and PSK extension
...
Medium: apr
Issue Overview: Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data. This issue does not affect non-Unix platforms, or builds with APRUSESHMEMSHMGET=1 apr...
CVE-2024-47834
GStreamer is a library for constructing graphs of media-handling components. An Use-After-Free read vulnerability has been discovered affecting the processing of CodecPrivate elements in Matroska streams. In the GSTMATROSKAIDCODECPRIVATE case within the gstmatroskademuxparsestream function, a dat...
Vulnerability of components of Linux operating system’s kernel, net/mlx5, allowing attackers to gain elevated privileges within the system
The vulnerability of the net/mlx5 components in the Linux operating system’s kernel is related to the state of the race condition when a shared resource is used. Exploiting this vulnerability can allow an attacker to gain elevated privileges within the system...
PT-2024-40144 · Pqclean · Pqclean
Name of the Vulnerable Software and Affected Versions: PQClean affected versions not specified Description: A correctness error has been identified in the reference implementation of the HQC key encapsulation mechanism, where an indexing error causes part of the secret key to be incorrectly treat...
CVE-2024-45494
An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 Fixed in 7.0.0. The FieldServer Gateway has an internally used shared administrative user account on all devices. The authentication for this user is implemented through an unsafe shared secret that is static in all affected...
PT-2024-9423 · Microsoft · Windows
Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to a Lightweight Directory Access Protocol LDAP client remote code execution. It is caused by synchronization errors when using a shared resource. This allows a remote...
MSA Safety FieldServer 安全漏洞
MSA Safety FieldServer is a building automation solution from MSA Safety USA. A security vulnerability exists in MSA Safety FieldServer versions prior to 7.0.0 that stems from the FieldServer gateway's authentication on all devices being implemented with an insecure shared key that is static acro...
PT-2024-9420 · Microsoft · Windows Kernel +1
Name of the Vulnerable Software and Affected Versions: Windows Kernel affected versions not specified Description: The issue is related to an elevation of privilege vulnerability in the Windows kernel, which is caused by synchronization errors when using a shared resource, also known as a "race...
CVE-2024-45494
An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 Fixed in 7.0.0. The FieldServer Gateway has an internally used shared administrative user account on all devices. The authentication for this user is implemented through an unsafe shared secret that is static in all affected...
CVE-2024-45494
An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 Fixed in 7.0.0. The FieldServer Gateway has an internally used shared administrative user account on all devices. The authentication for this user is implemented through an unsafe shared secret that is static in all affected...
CVE-2024-45494
The CVE affects MSA FieldServer Gateway versions 5.0.0–6.5.2 (fixed in 7.0.0). A shared administrative user on all devices uses an unsafe, static secret for authentication, enabling potential unauthorized admin access. The issue is described with high impact across confidentiality, integrity, and...
Malicious code in mona-shared (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-11401 Malicious code in mona-shared (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in mona-manager-plugins-shared (npm)
--- -= Per source details. Do not edit below this line.=-...
The vulnerability of the channel_request_lookahead() function in the WSGI server for Python Waitress allows a attacker to send hidden HTTP requests (HTTP Request Smuggling attack).
The vulnerability of the channelrequestlookahead function in the WSGI server for Python Waitress is related to synchronization errors when using shared resources due to inconsistent interpretation of HTTP requests. Exploiting this vulnerability allows a remote attacker to send hidden HTTP request...
Malicious code in @mysas/shared (npm)
--- -= Per source details. Do not edit below this line.=-...
SUSE CVE-2024-54137
liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. A correctness error has been identified in the reference implementation of the HQC key encapsulation mechanism. Due to an indexing error, part of the secret key is incorrectly treat...
GHSA-3HPF-FF72-J67P shared_preferences_android vulnerability
Impact Due to some data types not being natively representable for the available storage options, sharedpreferencesandroid serializes and deserializes special string prefixes to store these unrepresentable data types. This allows arbitrary classes to be deserialized leading to arbitrary code...
shared_preferences_android vulnerability
Impact Due to some data types not being natively representable for the available storage options, sharedpreferencesandroid serializes and deserializes special string prefixes to store these unrepresentable data types. This allows arbitrary classes to be deserialized leading to arbitrary code...