13092 matches found
Deserialization Of Untrusted Data
hutool-core is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to the readObjectFromXml function in XmlUtil.java which doesn't properly decode the object when parsing the XML string, allowing an attacker to inject and execute malicious commands...
CVE-2023-25193 vulnerabilities
Vulnerabilities for packages: openjdk...
CVE-2023-23087
An issue was found in MojoJson v1.2.3 allows attackers to execute arbitary code via the destroy function...
CVE-2022-25916
Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scan' function...
ASB-A-244154558
In run of ChooseTypeAndAccountActivity.java, there is a possible escalation of privilege due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
MAL-2023-892 Malicious code in tohe-doc-resources (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17a9a9c63d20d34ca8cd59f2c43090e89223718888b73e20c38ba84477ee6d02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
The vulnerability of the 3D Builder software for designing and preparing objects for 3D printing lies in insufficient validation of input data, allowing a hacker to execute arbitrary code.
The vulnerability of the 3D Builder software for designing and preparing objects for 3D printing is related to insufficient verification of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created file...
SUSE-SU-2023:0215-1 Security update for apache2-mod_auth_openidc
This update for apache2-modauthopenidc fixes the following issues: - CVE-2022-23527: Fixed open redirect in oidcvalidateredirecturl using tab character bsc1206441. - CVE-2021-39191: Fixed open redirect issue in targetlinkuri parameter bsc1190223...
MAL-2023-988 Malicious code in yandex-meteo-flow (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad598f1585a297ca8d20439b26fa25afb526a1f69cbdde3832e457b6daa6cf83 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
GHSA-3CHW-8JQ2-W769 Froxlor contains Unchecked Error Condition
Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10...
DLA-3292-1 sofia-sip - security update
Bulletin has no description...
GHSA-6325-6G32-7P35 flash_tool Gem for Ruby File Download Handling Arbitrary Command Execution
flashtool Gem for Ruby contains a flaw that is triggered during the handling of downloaded files that contain shell characters. With a specially crafted file, a context-dependent attacker can execute arbitrary commands...
GHSA-9WRR-4R9V-26XC CSRF vulnerability in Jenkins Keycloak Authentication Plugin
A cross-site request forgery CSRF vulnerability in Jenkins Keycloak Authentication Plugin 2.3.0 and earlier allows attackers to trick users into logging in to the attacker's account...
CVE-2023-0284
Improper Input Validation of LDAP user IDs in Tribe29 Checkmk allows attackers that can control LDAP user IDs to manipulate files on the server. Checkmk = 2.1.0p19, Checkmk = 2.0.0p32, and all versions of Checkmk 1.6.0 EOL are affected...
CVE-2023-0493 Improper Neutralization of Equivalent Special Elements in btcpayserver/btcpayserver
Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5...
DSA-5329-1 bind9 - security update
Bulletin has no description...
CVE-2023-0438 Cross-Site Request Forgery (CSRF) in modoboa/modoboa
Cross-Site Request Forgery CSRF in GitHub repository modoboa/modoboa prior to 2.0.4...
OPENSUSE-SU-2023:0027-1 Security update for tor
This update for tor fixes the following issues: tor 0.4.7.13: fix SafeSocks option to avoid DNS leaks boo1207110, TROVE-2022-002 improve congestion control fix relay channel handling tor 0.4.7.12: new key for moria1 new metrics are exported on the MetricsPort for the congestion control subsystem...
bumpalo has use-after-free due to a lifetime error in `Vec::into_iter()`
In affected versions of this crate, the lifetime of the iterator produced by Vec::intoiter is not constrained to the lifetime of the Bump that allocated the vector's memory. Using the iterator after the Bump is dropped causes use-after-free accesses. The following example demonstrates memory...