13092 matches found
BELL-CVE-2023-43804
Bulletin has no description...
SA-2023-08-08-CVE-2023-35083
SECURITY ADVISORY 08-08-2023 Product Affected: Ivanti Endpoint Manager A vulnerability was recently discovered for EPM 2022 SU3 and all previous versions. We have a Hotfix available to remediate this vulnerability that can be found by going to CVE-2023-35083 Full details. Please log into the...
SUSE-SU-2023:3949-1 Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues: Mozilla Firefox was updated to 115.3.1 ESR, fixing a security issue: MFSA 2023-44 bsc1215814 CVE-2023-5217: Fixed a heap buffer overflow in libvpx...
Cross-Site Scripting (XSS)
html/template is vulnerable to Cross-Site Scripting XSS attacks. The vulnerability exists because the package does not properly handle HTML-like "" comment tokens, nor hashbang "!" comment tokens, in...
BELL-CVE-2023-5344
Bulletin has no description...
OSV-2023-940 Heap-buffer-overflow in _dwarf_memcpy_swap_bytes
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62842 Crash type: Heap-buffer-overflow READ 1 Crash state: dwarfmemcpyswapbytes fillinuniarch64 dwarfmachosetup...
ASB-A-294779649
Bulletin has no description...
ASB-A-273874525
In buildreadmultirsp of gattsr.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote proximal/adjacent code execution with no additional execution privileges needed. User interaction is not needed for exploitation...
ASB-A-274058082
In androidviewInputDevicecreate of androidviewInputDevice.cpp, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
PUB-A-261492822
Bulletin has no description...
CVE-2023-5207 Execution with Unnecessary Privileges in GitLab
A vulnerability was discovered in GitLab CE and EE affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. An authenticated attacker could perform arbitrary pipeline execution under the context of another user...
CVE-2023-2233 Missing Authorization in GitLab
An improper authorization issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.2.8, all versions starting from 16.3 before 16.3.5 and all versions starting from 16.4 before 16.4.1. It allows a project reporter to leak the owner's Sentry instance projects...
CVE-2023-5176
Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox 118, Firefox ESR...
sing-box vulnerable to improper authentication in the SOCKS inbound
Impact This vulnerability allows specially crafted requests to bypass authentication, affecting all SOCKS inbounds with user authentication. Patches Update to sing-box 1.4.5 or 1.5.0-rc.5 and later versions. Workarounds Don't expose the SOCKS5 inbound to insecure environments...
CVE-2022-4244 Codehaus-plexus: directory traversal
A flaw was found in codeplex-codehaus. A directory traversal attack also known as path traversal aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash ../" sequences and their variations or by using absolute file paths, it may be possib...
BELL-CVE-2023-5158
Bulletin has no description...
Malicious code in optimize-procurement-and-inventory-with-ai (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1d4a974419b1ab87d44f6d1c5cfd7fac97f037b476328f114d344113cf6bbd6f The OpenSSF Package Analysis project identified 'optimize-procurement-and-inventory-with-ai' @ 6.1.8 npm as malicious. It is considered maliciou...
MAL-2023-8191 Malicious code in @zettle-bo/bank-settings (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c565236f7920d5e91efa88abc8e86c0b09894525e980f20ca14654a57126c8b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
