5549 matches found
CVE-2024-43093
CVE-2024-43093 affects the Android Framework component ExternalStorageProvider.java, where a bypass of a file-path filter can occur due to incorrect Unicode normalization. The root issue can allow local escalation of privilege without extra execution privileges, with exploitation requiring user i...
Google Android 安全漏洞
Google Android is a Linux-based open source operating system from the American company Google. Google Android suffers from a security vulnerability that stems from incorrect Unicode normalization. An attacker can exploit the vulnerability to elevate privileges...
[SECURITY] Fedora 40 Update: python-werkzeug-3.0.6-1.fc40
Werkzeug =3D=3D=3D=3D=3D=3D=3D=3D Werkzeug started as simple collection of various utilities for WSGI applications and has become one of the most advanced WSGI utility modules. It includes a powerful debugger, full featured request and response objects, HTTP utilities to handle entity tags, cache...
Artifex Ghostscript 安全漏洞
Artifex Ghostscript is a free software package from Artifex, Inc. based on Adobe, PostScript, and the Portable Document Format page description language. A security vulnerability exists in Artifex Ghostscript prior to version 10.04.0, which stems from a directory traversal vulnerability due to lo...
CVE-2024-47611
XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows MinGW-w64 or MSVC, the command line tools from XZ Utils 5.6.2 and older have a command line argument injection vulnerability. If a command line contains Unicode characters for exampl...
CVE-2024-50089
In the Linux kernel, the following vulnerability has been resolved: unicode: Don't special case ignorable code points We don't need to handle them separately. Instead, just let them decompose/casefold to themselves...
CVE-2024-50089
CVE-2024-50089 is rejected by the CVE Numbering Authority and does not represent an active vulnerability.
Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data v4.8.6 is vulnerable to multiple Operator package issues
Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data v4.8.6 is vulnerable to multiple Operator package issues. We have performed updates to the Operators used by our Speech Services. The following vulnerabilities have been addressed in this update. Please read the details for...
Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Thephpleague Flysystem
CVE-2021-32708 Affected versions of this package are vulnerabl...
Security Bulletin: Due to use of International Components for Unicode, IBM Rational ClearQuest is vulnerable to buffer overflow.
Summary Multiple vulnerabilities in International Components for Unicode used within IBM Rational ClearQuest have been addressed CVE-2020-10531, CVE-2011-4599, CVE-2014-8146 Vulnerability Details CVEID:CVE-2020-10531 DESCRIPTION: International Components for Unicode ICU for C/C++ is vulnerable to...
Malicious code in plugin-transform-unicode-sets-regex (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-9771 Malicious code in plugin-transform-unicode-sets-regex (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in plugin-transform-unicode-property-regex (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-9770 Malicious code in plugin-transform-unicode-property-regex (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in plugin-syntax-unicode-sets-regex (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-9758 Malicious code in plugin-syntax-unicode-sets-regex (npm)
--- -= Per source details. Do not edit below this line.=-...
PT-2024-40609 · Poco · Poco
Name of the Vulnerable Software and Affected Versions: Poco affected versions not specified Description: The issue is related to a crash caused by an unknown read. Technical details about the crash include the involvement of Poco::UTF16Encoding::queryConvert, Poco::TextConverter::convert, and...
GitHub, Telegram Bots, and ASCII QR Codes Abused in New Wave of Phishing Attacks
A new tax-themed malware campaign targeting insurance and finance sectors has been observed leveraging GitHub links in phishing email messages as a way to bypass security measures and deliver Remcos RAT, indicating that the method is gaining traction among threat actors. "In this campaign,...
python-django: Potential denial-of-service vulnerability in django.utils.html.urlize() and AdminURLFieldWidget
A flaw was found in Django. 'urlize', 'urlizetrunc', and 'AdminURLFieldWidget' may be subject to a denial of service attack via certain inputs with a very large number of Unicode characters...