Denial Of Service (DoS)

github.com/tidwall/gjson is vulnerable to Denial Of Service DoS. The vulnerability is due to improper bounds checking during JSON parsing within gjson.go. This can leads to DoS if the application parses untrusted input...

CVE-2024-0668

The Advanced Database Cleaner plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.3 via deserialization of untrusted input in the 'processbulkaction' function. This makes it possible for authenticated attacker, with administrator access and above, ...

Deserialization of untrusted data

The Advanced Database Cleaner plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.3 via deserialization of untrusted input in the 'processbulkaction' function. This makes it possible for authenticated attacker, with administrator access and above, ...

Deserialization of untrusted data

The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. I...

Low: snakeyaml

Issue Overview: Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow. CVE-2022-38752 Affected Packages: snakeyaml Note: Th...

Vim 安全漏洞

Vim is a cross-platform text editor. A buffer overflow vulnerability exists in Vim versions prior to 9.0.2142, which stems from a boundary error when the application handles untrusted input. A remote attacker could exploit this vulnerability to execute arbitrary code on the system or cause a deni...

PT-2024-6708 · Synology · Synology Drive Client

Name of the Vulnerable Software and Affected Versions: Synology Drive Client versions prior to 3.3.0-15082 Description: The issue is related to the inclusion of functionality from an untrusted control sphere in the OpenSSL DLL component. This allows local users to execute arbitrary code via...

Apollo Cross-Site Scripting Vulnerability

Apollo is a set of PHP scripts by Alex Breen, an individual developer. It is intended to provide a web-based interface for students to upload coursework. A cross-site scripting vulnerability exists in Apollo apollo-client-nextjs versions prior to 0.7.0, which stems from mishandling of untrusted...

GHSA-9V9H-CGJ8-H64P Null pointer dereference in PKCS12 parsing

Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates...

GHSA-9F9P-CP3C-72JF Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') in trillium-http and trillium-client

Summary Insufficient validation of outbound header values may lead to request splitting or response splitting attacks in scenarios where attackers have sufficient control over outbound headers. Details Outbound trilliumhttp::HeaderValue and trilliumhttp::HeaderName can be constructed infallibly a...

Stack overflow during recursive JSON parsing

When parsing untrusted, deeply nested JSON, the stack may overflow, possibly enabling a Denial of Service attack. This was fixed by adding a check for recursion depth...

Advanced Database Cleaner < 3.1.4 - Administrator+ PHP Object Injection

Description The plugin is vulnerable to PHP Object Injection via deserialization of untrusted input in the 'processbulkaction' function. This makes it possible for authenticated attacker, with administrator access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin...

PT-2024-19995 · Unknown · Trillium-Http +1

Name of the Vulnerable Software and Affected Versions: trillium-http versions prior to 0.3.12 trillium-client versions prior to 0.5.4 Description: Insufficient validation of outbound header values may lead to request splitting or response splitting attacks in scenarios where attackers have...

PT-2024-1512 · Node.Js · Node.Js

Name of the Vulnerable Software and Affected Versions: network versions prior to 0.7.0 Description: The issue exists due to insufficient input validation in the child process exec function of the Node.js Network utility. This allows a remote attacker to execute arbitrary commands on the operating...

CVE-2023-49329

Anomali Match before 4.6.2 allows OS Command Injection. An authenticated admin user can inject and execute operating system commands. This arises from improper handling of untrusted input, enabling an attacker to elevate privileges, execute system commands, and potentially compromise the underlyi...

Command injection

Anomali Match before 4.6.2 allows OS Command Injection. An authenticated admin user can inject and execute operating system commands. This arises from improper handling of untrusted input, enabling an attacker to elevate privileges, execute system commands, and potentially compromise the underlyi...

PT-2024-13722 · Anomali · Anomali Match

Name of the Vulnerable Software and Affected Versions: Anomali Match versions prior to 4.6.2 Description: The issue arises from improper handling of untrusted input, enabling an attacker to inject and execute operating system commands. An authenticated admin user can elevate privileges, execute...

Anomali Match Security Vulnerability

Anomali Match is a big data security analytics engine from Anomali that automates threat detection, investigation and response. A security vulnerability exists in Anomali Match version 4.6.2 and prior versions, which stems from mishandling of untrusted input and could lead to an operating system...

Welcart e-Commerce < 2.9.6 - Admin+ PHP Object Injection

Description The plugin is vulnerable to PHP Object Injection in all versions up to 2.9.5 inclusive via deserialization of untrusted input in the welcartconfirmcheckajax function. This makes it possible for administrators to inject a PHP Object. No POP chain is present in the vulnerable plugin. If...

SUSE CVE-2023-6237

Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function EVPPKEYpubliccheck to check RSA public keys may experience long delays. Where the key that is being checked has been obtained from an untrusted source this may...