13092 matches found
CVE-2023-2838 Out-of-bounds Read in gpac/gpac
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2...
CVE-2023-24832
A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to crash an Hermes runtime where the EnableHermesInternal config option was set to true. Note that this is only exploitable in cases where Hermes is used to execut...
CVE-2023-32099 Key duplication in GSDK
Compiler removal of buffer clearing in slisesignhash in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM...
Identifying a Patch Management Solution: Overview of Key Criteria
Software is rarely a one-and-done proposition. In fact, any application available today will likely need to be updated – or patched – to fix bugs, address vulnerabilities, and update key features at multiple points in the future. With the typical enterprise relying on a multitude of applications,...
MGASA-2023-0164 Updated python-pillow packages fix security vulnerability
libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files. CVE-2022-30595 Improper Handling of Highly Compressed GIF Data Data Amplification. CVE-2022-45198...
DLA-3421-1 thunderbird - security update
Bulletin has no description...
OSV-2023-397 Heap-buffer-overflow in json_write_TF
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58915 Crash type: Heap-buffer-overflow READ 1 Crash state: jsonwriteTF jsonpreR13headerwriteprivate dwgwritejson...
MAL-2023-1212 Malicious code in innotecsaludo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c0835a79941b28db8905c92debfa5937bc9bb5707163402d7b82630d5f35fd14 The OpenSSF Package Analysis project identified 'innotecsaludo' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...
CVE-2023-27237
LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack...
PT-2023-18953 · Sick · Sick Flexi Classic +1
Name of the Vulnerable Software and Affected Versions: SICK Flexi Classic and Flexi Soft Gateways with Partnumbers 1042193, 1042964, 1044078, 1044072, 1044073, 1044074, 1099830, 1099832, 1127717, 1069070, 1112296, 1051432, 1102420, 1127487, 1121596, 1121597 Description: The issue allows an...
Malicious code in the-four-tendencies-the-indispensable-personality-profiles-that-reveal-how-to-make-your-life-better- (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d3e9297cd32e9acc254a75e4a5d526916cc24499d026cbc04de40218284ff849 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
GHSA-G947-422M-HR7P Duplicate Advisory: Pimcore Cross-site Scripting (XSS) in Static Routes name field
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mhpj-7m7h-8p6x. This link is maintained to preserve external references. Original Description Cross-site Scripting XSS - Generic in GitHub repository pimcore/pimcore prior to 10.5.21...
CVE-2023-31556
podofoinfo 0.10.0 was discovered to contain a segmentation violation via the function PoDoFo::PdfDictionary::findKeyParent...
CVE-2023-31979
Catdoc v0.95 was discovered to contain a global buffer overflow via the function processfile at /src/reader.c...
Arbitrary File Upload
kiwitcms is vulnerable to Arbitrary File Upload. The vulnerability exists because the library does not properly validate files uploaded, allowing an attacker to bypass the file upload restrictions by uploading a malicious .exe file or embedded JavaScript file, tricking people into clicking on the...
MAL-2023-19 Malicious code in 61nlwr0f_bpi (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8749d5e356aeb60a7eada139d59386b6a5d41ca503c9e3f90d8d8ef3c17f2d02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Apache Airflow vulnerable to stored Cross-site Scripting
Task instance details page in the UI is vulnerable to stored cross-site scripting. This issue affects Apache Airflow before 2.6.0...
CVE-2023-29942
llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::Type::isamlir::LLVM::LLVMVoidType...
Information Disclosure
payload is vulnerable to Information Disclosure. An attacker can access hidden fields on readable collections they don't have authorization for via a brute force attack...