CVE-2023-25848

ArcGIS Enterprise Server (ArcGIS Enterprise Server versions 11.0 and below) contains an information-disclosure vulnerability. A remote, unauthenticated attacker can submit a crafted query that may disclose information limited to a single attribute in a database connection string; no business data...

CVE-2023-25848 BUG-000158039 - There is an information disclosure issue in ArcGIS Server.

ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query that may result in a low severity information disclosure issue. The information disclosed is limited to a single attribute in a database...

(Pwn2Own) HP Color LaserJet Pro M479fdw NotifyTo Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of HP Color LaserJet Pro M479fdw printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of the NotifyTo element. The issue results from th...

Cisco Firepower 4100 Series, Firepower 9300 Security Appliances, and UCS 6300 Series Fabric Interconnects SNMP Denial of Service Vulnerability

A vulnerability in the Simple Network Management Protocol SNMP service of Cisco FXOS Software for Firepower 4100 Series and Firepower 9300 Security Appliances and of Cisco UCS 6300 Series Fabric Interconnects could allow an authenticated, remote attacker to cause a denial of service DoS condition...

DEBIAN-CVE-2022-37052

A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject...

Remote Code Execution (RCE)

org.jenkins-ci.plugins: convert-to-pipeline is vulnerable to Remote Code Execution RCE. The vulnerability exists due to improperly converting the build environment, build steps, and post-build actions of freestyle projects to the corresponding pipeline step invocations via simple string...

Security Bulletin: IBM Informix JDBC Driver Is Vulnerable to Remote Code Execution (CVE-2023-27866)

Summary IBM Informix JDBC Driver is susceptible to remote code execution attack. This vulnerability is addressed. Vulnerability Details CVEID:CVE-2023-27866 DESCRIPTION: IBM Informix JDBC Driver is susceptible to remote code execution attack via JNDI injection when driver code or the application...

Qt 安全漏洞

Qt is a cross-platform C++ application development framework from the Norwegian company Qt. It is widely used to develop GUI programs, in which case it is also known as the widget toolkit. Can also be used to develop non-GUI programs, such as console tools and servers. A security vulnerability...

CVE-2023-37369

In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a prefix is greater than a length...

[SECURITY] Fedora 38 Update: qt5-qtbase-5.15.10-5.fc38

Qt is a software toolkit for developing applications. This package contains base tools, like string, xml, and network handling...

PT-2023-4495 · Pdf Xchange · Pdf-Xchange Editor

Name of the Vulnerable Software and Affected Versions: PDF-XChange Editor affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this, where the target must...

PDF-XChange Editor JavaScript String Untrusted Pointer Dereference Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

Cross site request forgery (csrf)

Oppia is an online learning platform. When comparing a received CSRF token against the expected token, Oppia uses the string equality operator ==, which is not safe against timing attacks. By repeatedly submitting invalid tokens, an attacker can brute-force the expected CSRF token character by...

DEBIAN-CVE-2023-38855

Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the getstring function in xlstool.c:395...

PT-2023-26637 · Libxls +1 · Libxls +1

Name of the Vulnerable Software and Affected Versions: libxlsv version 1.6.2 Description: The issue allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the get string function in xlstool.c:411. Recommendations: For libxlsv version 1.6.2,...

Ivanti Avalanche SecureFilter allowPassThrough Authentication Bypass Vulnerability

This vulnerability allows remote attackers to partially bypass authentication on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the allowPassThrough method. The issue results from incorrect string matching...

CVE-2023-40295

libboron in Boron 2.0.8 has a heap-based buffer overflow in urstrInitUtf8 at string.c...

CVE-2023-40295

libboron in Boron 2.0.8 has a heap-based buffer overflow in urstrInitUtf8 at string.c...

OESA-2023-1490 qt5-qtbase security update

Qt is a software toolkit for developing applications. Security Fixes: Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before...

CVE-2023-39946

eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6, heap can be overflowed by providing a PIDPROPERTYLIST parameter that contains a CDR string with length larger than the size of...