16961 matches found
CVE-2023-52450 perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology()
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix NULL pointer dereference issue in upifilltopology Get logical socket id instead of physical id in discoverupitopology to avoid out-of-bound access on 'upi = &type-topologynididx;' line that leads to NUL...
Arbitrary Code Execution
pymatgen is vulnerable to Arbitrary Code Execution. The vulnerability is due to missing input sanitization within the JonesFaithfulTransformation.fromtransformationstr method, allowing an attacker to execute malicious code within the context of the application...
BELL-CVE-2023-52435
Bulletin has no description...
BELL-CVE-2023-52434
Bulletin has no description...
BELL-CVE-2023-52437
Bulletin has no description...
CVE-2024-25369
A reflected Cross-Site Scripting XSS vulnerability in FUEL CMS 1.5.2allows attackers to run arbitrary code via crafted string after the groupid parameter...
CVE-2024-25385
An issue in flvmeta v.1.2.2 allows a local attacker to cause a denial of service via the flvmeta/src/flv.c:375:21 function in flvclose...
PYSEC-2024-226
Pymatgen Python Materials Genomics is an open-source Python library for materials analysis. A critical security vulnerability exists in the JonesFaithfulTransformation.fromtransformationstr method within the pymatgen library prior to version 2024.2.20. This method insecurely utilizes eval for...
UBUNTU-CVE-2023-42843
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1, Safari 17.1, macOS Sonoma 14.1. Visiting a malicious website may lead to address bar spoofing...
Insufficiently Random Values
dfinity/auth-client and dfinity/identity are vulnerable to insecure key generation. The vulnerability is due to the Ed25519KeyIdentity.generate function as it uses an insecure seed for key pair generation when no seed value is provided. This flaw breaks the guarantee of secure randomness and can...
GHSA-Q3GG-M8HR-H4X4 Externally Controlled Format String in Scripting Functions
The rquickjs crate used by SurrealDB implements Rust bindings to the QuickJS C library and is used to execute SurrealDB scripting functions. The rquickjs function Exception::throwtype takes a string and returns an error object. Prior to version 0.4.2 of the crate, this string would be fed directl...
PT-2024-20566 · Unknown · Soninow Team Debug
Name of the Vulnerable Software and Affected Versions: SoniNow Team Debug versions 1.10 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that...
CVE-2024-21682
This High severity Injection vulnerability was introduced in Assets Discovery 1.0 - 6.2.0 all versions. Assets Discovery, which can be downloaded via Atlassian Marketplace, is a network scanning tool that can be used with or without an agent with Jira Service Management Cloud, Data Center or...
GHSA-QM43-G2XJ-HVG5 Liferay Portal and Liferay DXP User Enumeration Vulnerability
User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to determine if an account exist in the application by...
GHSA-QPGH-6V9W-VFV6 Liferay Portal and Liferay DXP Does Not Properly Restrict Membership to Child Site Based on Parent Site Options
Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not properly restrict membership of a child site when the "Limit membership to members of the parent site" option is enabled,...
BELL-CVE-2024-1580
Bulletin has no description...
The vulnerability of the 3D model texturing software Adobe Substance 3D Painter, related to reading beyond the buffer in memory, allows a hacker to execute arbitrary code.
The vulnerability of the 3D model texturing software Adobe Substance 3D Painter lies in the reading of data beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
The vulnerability of the devices/vector/gdevtxtw.c component of the software for processing, transforming, and generating Ghostscript documents allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the devices/vector/gdevtxtw.c component of the software for processing, transforming, and generating Ghostscript documents is related to an incorrect definition of the size of the buffer space that is freed during operation. Exploiting this vulnerability could allow a malicio...