Design/Logic Flaw

Certain WithSecure products have a buffer over-read whereby processing certain fuzz file types may cause a denial of service DoS. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and late...

Security Bulletin: IBM TRIRIGA Application Platform discloses server-side request forgery (CVE-2020-11988)

Summary CV-2020-11988 Apache XML Graphis Commons is vulerable to server-side request forgery. Vulnerability Details CVEID: CVE-2020-11988 DESCRIPTION: Apache XML Graphics Commons is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a...

OSV-2023-1166 Memcpy-param-overlap in repeat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64176 Crash type: Memcpy-param-overlap Crash state: repeat pere pere...

OSV-2023-1164 Heap-buffer-overflow in WriteCLUT

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64166 Crash type: Heap-buffer-overflow READ 4 Crash state: WriteCLUT cmsGetPostScriptColorResource cmsGetPostScriptCRD...

MAL-2023-8517 Malicious code in @airslate/front-locales (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e41b723776c055272b1cc4c219aba6cfae1a13b0ff87d90e8f0667b79d626e00 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Buffer Overflow

free5gc is vulnerable to Buffer Overflow. The vulnerability allows an attacker to submit crafted PFCP messages resulting in a buffer overflow, potentially leading to Denial of Service...

SendPress Newsletters < 1.23.11.6 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Auto Affiliate Links < 6.4.2.5 - Settings Update to Stored XSS via CSRF

Description The plugin does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2023-48014

GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a stack overflow via the hevcparsevpsextension function at /mediatools/avparsers.c...

CVE-2023-48011

GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a heap-use-after-free via the flushrefsamples function at /gpac/src/isomedia/moviefragments.c...

The vulnerability of the software for designing, operating, and maintaining COMOS technological installations lies in the transfer of accounting data in unencrypted form, allowing a perpetrator to gain access to configuration data.

The vulnerability of COMOS’ software for the design, operation, and maintenance of technological installations lies in the transfer of accounting data in an unencrypted form. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to configuration data...

GHSA-Q57G-38PC-JWV8 Microweber Improper Access Control vulnerability

Improper Access Control in GitHub repository microweber/microweber prior to 2.0.0...

PYSEC-2023-304

vantage6 is a framework to manage and deploy privacy enhancing technologies like Federated Learning FL and Multi-Party Computation MPC. In affected versions a node does not check if an image is allowed to run if a parentid is set. A malicious party that breaches the server may modify it to set a...

CVE-2023-31273

Protection mechanism failure in some Intel DCM software before version 5.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access...

CVE-2023-23583

Sequence of processor instructions leads to unexpected behavior for some IntelR Processors may allow an authenticated user to potentially enable escalation of privilege and/or information disclosure and/or denial of service via local access...

Improper access control

Improper access control in some IntelR OFU software before version 14.1.31 may allow an authenticated user to potentially enable escalation of privilege via local access...

Privilege escalation

Insecure inherited permissions in some IntelR Simics Simulator software before version 1.7.2 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-34430

Uncontrolled search path in some Intel Battery Life Diagnostic Tool software before version 2.2.1 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2022-33898

CVE-2022-33898 describes insecure inherited permissions in the Intel NUC Watchdog Timer software installer prior to version 2.0.21.0, potentially allowing an authenticated user to escalate privileges via local access. The Red Hat advisory reiterates the same description and lists affected Intel N...

CVE-2023-32283

Insertion of sensitive information into log file in some IntelR On Demand software before versions 1.16.2, 2.1.1, 3.1.0 may allow an authenticated user to potentially enable information disclosure via local access...