16962 matches found
GHSA-V444-JGGX-6V7F Duplicate Advisory: Race Condition leading to logging errors
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hjp3-5g2q-7jww. This link is maintained to preserve external references. Original Description A race condition exists in Audited 4.0.0 to 5.3.3 that can result in an authenticated user to cause audit log entries...
CVE-2024-0241 encoded_id-rails Denial of Service Vulnerability
encodedid-rails versions before 1.0.0.beta2 are affected by an uncontrolled resource consumption vulnerability. A remote and unauthenticated attacker might cause a denial of service condition by sending an HTTP request with an extremely long "id" parameter...
CVE-2024-22048 govuk_tech_docs XSS Vulnerability
govuktechdocs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's browser if a malicious search result is displayed on the search page...
CVE-2024-21625 One-click remote code execution via malicious deep link
SideQuest is a place to get virtual reality applications for Oculus Quest. The SideQuest desktop application uses deep links with a custom protocol sidequest:// to trigger actions in the application from its web contents. Because, prior to version 0.10.35, the deep link URLs were not sanitized...
CVE-2023-49625
Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the partylisteditsubmit.php resource does not validate the characters received and they are sent unfiltered to the database...
Timing Attack
github.com/cubefs/cubefs is vulnerability to Timing Attack. The vulnerability is due to raw string comparisons within the CubeFS master component. This allow an attacker to steal user passwords by observing the timing between password attempts...
SQL Injection
gilacms/gila is vulnerable to SQL Injection. The vulnerability is due to improper userid parameter sanitization within the login portal, which allows an attacker to execute arbitrary web scripts which results in SQL injection...
Kashipara Billing Software SQL Injection Vulnerability
Kashipara Billing Software is an application from Kashipara India. A SQL injection vulnerability exists in the v1.0 version of Kashipara Billing Software, which originates when the bankdetails parameter of the partysubmit.php page is processed without filtering the data and sending it to the...
Intel® Rapid Storage Technology Software Advisory
Summary: A potential security vulnerability in some Intel® Rapid Storage Technology software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2023-39230 Description: Insecure inherited permissions in...
CVE-2023-6004 Libssh: proxycommand/proxyjump features allow injection of malicious code through hostname
A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter...
GHSA-RG9Q-M8HV-XXR6 PaddlePaddle floating point exception in paddle.lerp
FPE in paddle.lerp in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service...
CVE-2024-0209 NULL Pointer Dereference in Wireshark
IEEE 1609.2 dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted capture file...
BELL-CVE-2023-51780
Bulletin has no description...
Gila CMS SQL Injection vulnerability
A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts via the 'userid' parameter after the login portal...
MC4WP < 4.9.10 - Unauthenticated Unpublished Form Preview
Description The plugin is vulnerable to unauthorized access of data due to a missing capability check on the 'listen' function, allowing unauthenticated attackers to preview unpublished forms...
CVE-2023-51652 OWASP.AntiSamy mXSS when preserving comments
OWASP AntiSamy .NET is a library for performing cleansing of HTML coming from untrusted sources. Prior to version 1.2.0, there is a potential for a mutation cross-site scripting mXSS vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerabilit...
BELL-CVE-2024-0193
Bulletin has no description...
MAL-2024-12 Malicious code in @serenity-web/common-assets (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1958105778b66cb3d83e65931c92543bf2777f57632f516f4b592808317e4b95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
OSV-2023-1375 Heap-buffer-overflow in IEC104Stats::processPacket
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65402 Crash type: Heap-buffer-overflow READ 1 Crash state: IEC104Stats::processPacket Flow::processIEC60870Packet NetworkInterface::processPacket...