CLSA-2024-1726314076 python2: Fix of CVE-2023-27043

Bugfix for CVE-2023-27043, use str instead of unicode, adjust tests according to python2 specification...

PT-2024-41529

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538161 Crash type: UNKNOWN WRITE Crash state: bfd elf get str section bfd elf string from elf section bfd elf sym name...

CLSA-2024-1725544866 python2: Fix of CVE-2023-27043

Bugfix for CVE-2023-27043, use str instead of unicode, adjust tests according to python2 specification...

CLSA-2024-1725382525 python: Fix of CVE-2023-27043

Bugfix for CVE-2023-27043, use str instead of unicode, adjust tests according to python2 specification...

CVE-2024-5991

In function MatchDomainName, input param str is treated as a NULL terminated string despite being user provided and unchecked. Specifically, the function X509checkhost takes in a pointer and length to check against, with no requirements that it be NULL terminated. If a caller was attempting to do...

PT-2024-33707

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: A vulnerability in the Linux kernel has been identified where the description show function accesses invalid memory if the return type of the STR method is not a buffer object. Only buffer...

RUSTSEC-2024-0359 The kstring integration in gix-attributes is unsound

gix-attributes in state::ValueRef unsafely creates a &str from a &u8 containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB: rust // SAFETY: our API makes accessing that value as str impossible, so illformed...

The kstring integration in gix-attributes is unsound

gix-attributes in state::ValueRef unsafely creates a &str from a &u8 containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB: rust // SAFETY: our API makes accessing that value as str impossible, so illformed...

PT-2024-33321

Name of the Vulnerable Software and Affected Versions Tongda OA version 2017 Description A critical issue has been identified, affecting the file /general/meeting/manage/delete.php. The manipulation of the M ID STR argument leads to SQL injection. This issue can be exploited remotely. The exploit...

PT-2024-6211

Name of the Vulnerable Software and Affected Versions HDF5 Library versions prior to 1.14.4 Description The issue is related to the h5tools str sprint function in the h5tools str.c file of the HDF5 Library, which may attempt to dereference uninitialized values. This could potentially allow an...

PT-2024-2168

Name of the Vulnerable Software and Affected Versions GGUF library version Commit 18c2e17 Description A heap-based buffer overflow vulnerability exists in the GGUF library gguf fread str functionality of llama.cpp. This vulnerability can be triggered by a specially crafted .gguf file, potentially...

PT-2024-40564 · Git +1 · Mruby

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read error. Technical details about the crash include the functions mrb memsearch, str convert range, and...

PT-2024-40558 · Git +1 · Mruby

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A heap-buffer-overflow READ 2 crash has been reported. The crash involves the following functions: mrb memsearch, mrb str split m, and mrb vm exec...

TONGDA Office Anywhere SQL Injection Vulnerability

TONGDA Office Anywhere is a collaborative office OA system. A SQL injection vulnerability exists in TONGDA Office Anywhere 2017 version 11.10 and earlier versions, which stems from an incorrect operation of the parameter DELETESTR that can lead to sql injection...

PT-2024-15923

Name of the Vulnerable Software and Affected Versions Tongda OA 2017 versions up to 11.9 Description A critical issue was found in Tongda OA 2017, affecting an unknown part of the file /general/email/inbox/delete webmail.php. The manipulation of the WEBBODY ID STR argument leads to sql injection...

PT-2023-32926

Name of the Vulnerable Software and Affected Versions Tongda OA 2017 versions up to 11.9 Description A critical issue has been found in Tongda OA 2017, affecting an unknown functionality of the file general/project/proj/delete.php. The manipulation of the PROJ ID STR argument leads to sql...

GHSA-7M7H-RGVP-3V4R hutool-core discovered to contain an infinite loop in the StrSplitter.splitByRegex function

hutool-core v5.8.23 was discovered to contain an infinite loop in the StrSplitter.splitByRegex function. This vulnerability allows attackers to cause a Denial of Service DoS via manipulation of the first two parameters...

PT-2023-32839

Name of the Vulnerable Software and Affected Versions Tongda OA versions 2017 up to 11.9 Description A critical issue affects an unknown functionality of the file general/work plan/manage/delete all.php. The manipulation of the DELETE STR argument leads to sql injection. The attack can be launche...

CVE-2023-6607

A vulnerability has been found in Tongda OA 2017 up to 11.10 and classified as critical. Affected by this vulnerability is an unknown functionality of the file general/wiki/cp/manage/delete.php. The manipulation of the argument TERMIDSTR leads to sql injection. The exploit has been disclosed to t...

PT-2023-32711

Name of the Vulnerable Software and Affected Versions Tongda OA versions 2017 up to 11.10 Description A critical issue has been found in an unknown functionality of the file general/wiki/cp/manage/delete.php. The manipulation of the TERM ID STR argument leads to SQL injection. The issue has been...