17005 matches found
CVE-2023-48235
Vim is an open source command line text editor. When parsing relative ex addresses one may unintentionally cause an overflow. Ironically this happens in the existing overflow check, because the line number becomes negative and LONGMAX - lnum will cause the overflow. Impact is low, user interactio...
CVE-2023-48235
Vim vulnerability CVE-2023-48235 involves an overflow while parsing relative ex addresses. The issue arises in the existing overflow check when the line number becomes negative, leading to LONG_MAX - lnum overflow. It is addressed in commit 060623e and has been included in Vim release 9.0.2110. I...
CVE-2023-48236 overflow in get_number in vim
Vim is an open source command line text editor. When using the z= command, the user may overflow the count with values larger than MAXINT. Impact is low, user interaction is required and a crash may not even happen in all situations. This vulnerability has been addressed in commit 73b2d379 which...
CVE-2023-48236
CVE-2023-48236 ( Vim ): The vulnerability arises when using the z= command; counts larger than MAX_INT may overflow. Affected versions prior to the patch release, resolved by commit 73b2d379 in Vim 9.0.2111. Upgrade to at least 9.0.2111 to address this. Impact is described as low, with user inter...
CVE-2023-48237 overflow in shift_line in vim
Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may be possible to overflow the size of integer. Impact is low, user interaction is required and a crash may not even happen in all situations. This...
CVE-2023-48237
CVE-2023-48237 (Vim) affects Vim’s shift operation in operator-pending mode when a very large value is used, potentially overflowing an integer. The issue is fixed in Vim commit 6bf131888 and has been included in version 9.0.2112. The described impact is low and user interaction is required; a cr...
Security Bulletin: IBM Storage Fusion may be vulnerable to Denial of Service via use of golang.org/x/net, x/crypto, and x/text (CVE-2022-30633, CVE-2022-27664, CVE-2022-28131, CVE-2022-41721, CVE-2021-43565, CVE-2022-27191, CVE-2022-32149)
Summary Golang's x/net, x/crypto and x/text are used by IBM Storage Fusion for networking, cryptography and internationalization. Vulnerabilities in these libraries include Inconsistent Interpretation of HTTP Requests, Uncontrolled Recursion, and Missing Release of Resource that could lead to a...
Mutation Cross-Site Scripting (mXSS)
tinymce is vulnerable to mutation cross-site scripting mXSS. The vulnerability is caused due to lack of sanitization in handling of text nodes.This could allow an attacker to inject malicious scripts...
apache-commons-text: variable interpolation RCE
A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code...
Oracle Linux 9 : podman (ELSA-2023-6474)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6474 advisory. - rebuild for following CVEs: CVE-2023-25173 CVE-2022-41724 CVE-2022-41725 CVE-2023-24537 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536 CVE-2022-41723...
UBUNTU-CVE-2023-48219
TinyMCE is an open source rich text editor. A mutation cross-site scripting mXSS vulnerability was discovered in TinyMCE’s core undo/redo functionality and other APIs and plugins. Text nodes within specific parents are not escaped upon serialization according to the HTML standard. If such text...
CVE-2023-48219 Special characters in unescaped text nodes can trigger mXSS in TinyMCE
TinyMCE is an open source rich text editor. A mutation cross-site scripting mXSS vulnerability was discovered in TinyMCE’s core undo/redo functionality and other APIs and plugins. Text nodes within specific parents are not escaped upon serialization according to the HTML standard. If such text...
CVE-2023-48219
Summary of CVE-2023-48219 (TinyMCE): A mutation XSS (mXSS) flaw in TinyMCE’s core undo/redo and related APIs/plugins arises from text nodes in certain parents not being escaped during serialization per HTML standards. If a text node contains a special internal marker, it can combine with other HT...
GHSA-V626-R774-J7F8 TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes
Impact A mutation cross-site scripting mXSS vulnerability was discovered in TinyMCE’s core undo/redo functionality and other APIs and plugins. Text nodes within specific parents are not escaped upon serialization according to the HTML standard. If such text nodes contain a special character...
TinyMCE -- mXSS in multiple plugins
TinyMCE reports: Special characters in unescaped text nodes can trigger mXSS when using TinyMCE undo/redo, getContentAPI, resetContentAPI, and Autosave plugin...
A week in security (November 06 – November 12)
Last week on Malwarebytes Labs: Defeating Little Brother requires a new outlook on privacy: Lock and Code S04E23 Medical research data Advarra stolen after SIM swap Okta breach happened after employee logged into personal Google account Introducing ThreatDown: A new chapter for Malwarebytes...
PT-2023-32444 · Byzoro · Byzoro Smart S85F Management Platform
Name of the Vulnerable Software and Affected Versions: Byzoro Smart S85F Management Platform version V31R02B10-01 Description: A problematic issue was found in the Byzoro Smart S85F Management Platform, affecting an unknown function of the file /login.php. The manipulation of the txt newpwd...
The vulnerability of the Validate JSP File function in the IntelliJ IDEA integrated development environment allows attackers to load any JAR files they desire.
The vulnerability of the Validate JSP File function in the IntelliJ IDEA integrated development environment is related to the transmission of critical information in open text. Exploiting this vulnerability allows a malicious actor to download arbitrary JAR files remotely...
The vulnerability of the texteditor.php component in the software for measuring solar energy generation, data display, and storage in SolarView Compact allows a hacker to execute arbitrary code.
The vulnerability of the texteditor.php component in the software used for measuring solar energy generation, data display, and storage in SolarView Compact is related to improper code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
