CVE-2023-39685: Improper Control of Generation of Code

An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service DoS via supplying a crafted JSON string...

CVE-2023-39685

An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service DoS via supplying a crafted JSON string...

CVE-2023-39685

An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service DoS via supplying a crafted JSON string...

PT-2023-27072 · Unknown · Hjson-Java

Name of the Vulnerable Software and Affected Versions: hjson-java versions up to v3.0.0 Description: The issue allows attackers to cause a Denial of Service DoS via supplying a crafted JSON string. This can lead to a StringIndexOutOfBoundsException. Recommendations: For hjson-java versions up to...

CVE-2023-40771

SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function...

CVE-2023-40771

SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function...

OSV-2023-777 Heap-buffer-overflow in dxf_fixup_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61901 Crash type: Heap-buffer-overflow READ 1 Crash state: dxffixupstring dxfheaderwrite dwgwritedxf...

SUSE CVE-2023-4577

When UpdateRegExpStatics attempted to access initialStringHeap it could already have been garbage collected prior to entering the function, which could potentially have led to an exploitable crash. This vulnerability affects Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2...

CLSA-2023-1693420133 Update of alt-php

Fixed possible memory leak - debian/patches/fix-possible-memory-leak.patch: added DestroyDrawInfo call when StringToList returns error...

Format string

RestrictedPython is a restricted execution environment for Python to run untrusted code. Python's "format" functionality allows someone controlling the format string to "read" all objects accessible through recursive attribute lookup and subscription from objects he can access. This can lead to...

UBUNTU-CVE-2023-41039

RestrictedPython is a restricted execution environment for Python to run untrusted code. Python's "format" functionality allows someone controlling the format string to "read" all objects accessible through recursive attribute lookup and subscription from objects he can access. This can lead to...

Mozilla Firefox security vulnerabilities

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox that originates when UpdateRegExpStatics attempts to access the initialStringHeap, which may be garbage-collected before it enters the function, which...

CBL Mariner 2.0 Security Update: qt5-qtbase (CVE-2023-37369)

The version of qt5-qtbase installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-37369 advisory. - In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an applicatio...

CVE-2023-25848

ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query that may result in a low severity information disclosure issue. The information disclosed is limited to a single attribute in a database...

Information disclosure

ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query that may result in a low severity information disclosure issue. The information disclosed is limited to a single attribute in a database...

CVE-2023-25848

ArcGIS Enterprise Server (ArcGIS Enterprise Server versions 11.0 and below) contains an information-disclosure vulnerability. A remote, unauthenticated attacker can submit a crafted query that may disclose information limited to a single attribute in a database connection string; no business data...

CVE-2023-25848 BUG-000158039 - There is an information disclosure issue in ArcGIS Server.

ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query that may result in a low severity information disclosure issue. The information disclosed is limited to a single attribute in a database...

CVE-2023-25848: Cleartext Transmission of Sensitive Information

ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query that may result in a low severity information disclosure issue. The information disclosed is limited to a single attribute in a database...

(Pwn2Own) HP Color LaserJet Pro M479fdw NotifyTo Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of HP Color LaserJet Pro M479fdw printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of the NotifyTo element. The issue results from th...

h2database:SqlStatementFuzzer: Security exception in java.base/java.util.Arrays.copyOfRange

Detailed Report: https://oss-fuzz.com/testcase?key=6154375767392256 Project: h2database Fuzzing Engine: libFuzzer Fuzz Target: SqlStatementFuzzer Job Type: libfuzzerasanh2database Platform Id: linux Crash Type: Security exception Crash Address: Crash State: java.base/java.util.Arrays.copyOfRange...