Fedora: Security Advisory for folly (FEDORA-2023-7934802344)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OAuth Identity XWiki App Cross-Site Scripting Vulnerability

OAuth Identity XWiki App is an open source XWiki SAS library of essential elements for building identities and service providers based on OAuth authorization. A cross-site scripting vulnerability exists in OAuth Identity XWiki App, which stems from the identityOAuth parameter sent in a GET reques...

TorchServe Pre-Auth Remote Code Execution

Impact Use of Open Source Library potentially exposed to RCE Issue: Use of a version of the SnakeYAML v1.31 open source library with multiple issues that potentially exposes the user to unsafe deserialization of Java objects. This could allow third parties to execute arbitrary code on the target...

Armeria 安全漏洞

Armeria is an open source library for building asynchronous microservers that use HTTP/2 as the session layer protocol. A security vulnerability exists in versions of Armeria prior to 1.24.3, which stems from a vulnerability that allows the use of JettyService paths containing matrix variables to...

CVE-2023-36464 Infinite Loop when a comment isn't followed by a character in pypdf

pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if parsecontentstream is executed. That is, for example, the case if the user extracted text from such a PDF. This issue was introduced in pull request 969 and resolv...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the yajltreeparse function. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users. Unlike other vulnerabilities, DoS attacks...

API Umbrella Web 跨站脚本漏洞

API Umbrella Web is an open source library from National Renewable Energy Laboratory. A cross-site scripting vulnerability exists in API Umbrella Web version 0.7.1, which stems from an issue with an unknown portion of the component Admin Data Table Handler that can lead to a cross-site scripting...

API Umbrella Web 跨站脚本漏洞

API Umbrella Web is an open source library from National Renewable Energy Laboratory. A cross-site scripting vulnerability exists in API Umbrella Web version 0.7.1, which stems from an issue with unknown code in the component Flash Message Handler that can lead to cross-site scripting...

definely 跨站脚本漏洞

definely is an open source library from Ritter Insurance Marketing. Designed to allow words and abbreviations to be created and linked to definely. A cross-site scripting vulnerability exists in definely. An attacker could exploit this vulnerability to perform a cross-site scripting attack...

show-me-the-way 跨站脚本漏洞

show-me-the-way is an open source library from OSM Lab. It is used to view OSM edits made in real time. A cross-site scripting vulnerability exists in OSM Lab show-me-the-way, which stems from some unknown handling of the file js/site.js being problematic and can lead to cross-site scripting...

Jettison 缓冲区错误漏洞

Jettison is jettison-json open source Jettison is a Java library . Jettison is a Java library that is used to convert XML to JSON with the help of StAX . Jettison v1.5.2 before the version of a security vulnerability , the vulnerability stems from a stack overflow , allowing an attacker to...

FF4J 安全漏洞

FF4J is a feature switching mode of FF4J open source implementation library . A security vulnerability exists in FF4J version 1.8.1 that stems from vulnerability to remote code execution RCE attacks...

Bento4 缓冲区错误漏洞

Bento4 is an open source C++ library for reading and writing MP4 files. A security vulnerability exists in Bento4 that stems from the presence of a heap-based buffer overflow problem...

The vulnerability of the `cv::PxMDecoder::readData` function in the `grfmt_pxm.cpp` component of the OpenCV library, which is used for computer vision, image processing, and numerical algorithms of general purpose, open-source computer vision. This vulnerability allows a attacker to cause a service denial.

The vulnerability of the cv::PxMDecoder::readData function in the grfmtpxm.cpp component of the Computer Vision, Image Processing, and Numerical Algorithms General Purpose Library OpenSource Computer Vision Library – OpenCV is related to the execution of operations outside of the buffer in memory...

Mz Automation Libiec61850 代码问题漏洞

Mz Automation Libiec61850 is an open source library for the IEC 61850 protocol from Mz Automation. Mz Automation Libiec61850 suffers from a code issue vulnerability that stems from its use of null pointers under certain circumstances. This could allow an attacker to crash the server...

GHSA-4RG6-FM25-GC34 oauth2-server through 3.1.1 vulnerable to Open Redirect

In oauth2-server aka node-oauth2-server through 3.1.1, the value of the redirecturi parameter received during the authorization and token request is checked against an incorrect URI pattern a-zA-Za-zA-Z0-9+.-+: before making a redirection. This allows a malicious client to pass an XSS payload...

OTFCC Buffer Overflow Vulnerability (CNVD-2024-08553)

OTFCC is Caryll open source a C library and utility programs. Used to parse and write OpenType font files. A buffer overflow vulnerability exists in OTFCC version 0.10.4, which stems from a lack of proper validation of user-supplied data in the /release-x64/otfccdump+0x6b84b1 file, and can be...

OTFCC 缓冲区错误漏洞

OTFCC is a C library and utility program from Caryll Open Source. It is used to parse and write OpenType font files. A security vulnerability exists in OTFCC version 0.10.4, which stems from a segmentation violation in the file /multiarch/memmove-vec-unaligned-erms...

OTFCC 缓冲区错误漏洞

OTFCC is a C library and utility program from Caryll Open Source. It is used to parse and write OpenType font files. A security vulnerability exists in OTFCC version 0.10.4, which stems from a heap buffer overflow in the /release-x64/otfccdump+0x6c08a6 file...

Ittiam Systems libmpeg2 安全漏洞

Ittiam Systems libmpeg2 is an open source library of MPEG-1 and MPEG-2 video stream decoding functions from Ittiam Systems. A security vulnerability exists in Ittiam Systems libmpeg2 versions prior to 2022-07-27, which stems from the use of memcpy with overlapping memory blocks, and can be...