Medium: snakeyaml

Issue Overview: Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. CVE-2022-38750 Using snakeYAML to parse untrusted YAM...

GTKWave 缓冲区错误漏洞

GTKWave is a full-featured, GTK+-based waveform viewer from GTKWave. A buffer overflow vulnerability exists in GTKWave version 3.3.115. The vulnerability stems from a boundary error in the fstReaderIterBlocks2 chaintable parsing function when processing untrusted input, which can be exploited by ...

PT-2024-15235 · Unknown · Chanzhaoyu Chatgpt-Web

Name of the Vulnerable Software and Affected Versions: Chanzhaoyu chatgpt-web version 2.11.1 Description: A problematic issue has been found in the software, affecting some unknown processing. The manipulation of the argument Description with the input leads to cross-site scripting. The attack ma...

Theme per user < 1.0.2 - Unauthenticated PHP Object Injection

Description The Theme per user plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 1.0.2 exclusive via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If...

YITH WooCommerce Product Add-Ons < 4.3.1 - Authenticated(Shop Manager+) PHP Object Injection

Description The YITH WooCommerce Product Add-Ons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 4.3.1 exclusive via deserialization of untrusted input in the 'saveaddon' function. This makes it possible for authenticated attackers, with Shop Manager access and...

PT-2024-18983 · Vapor · Vapor

Name of the Vulnerable Software and Affected Versions: Vapor versions prior to 4.90.0 Description: Vapor is an HTTP web framework for Swift. The vapor urlparser parse function uses uint16 t indexes when parsing a URI's components, which may cause integer overflows when parsing untrusted inputs...

CVE-2023-52262

outdoorbits little-backup-box aka Little Backup Box before f39f91c allows remote attackers to execute arbitrary code because the PHP extract function is used for untrusted input...

CVE-2023-52262

outdoorbits little-backup-box aka Little Backup Box before f39f91c allows remote attackers to execute arbitrary code because the PHP extract function is used for untrusted input...

CVE-2023-52262

outdoorbits little-backup-box aka Little Backup Box before f39f91c allows remote attackers to execute arbitrary code because the PHP extract function is used for untrusted input...

PT-2023-8937 · Outdoorbits · Little-Backup-Box

Name of the Vulnerable Software and Affected Versions: outdoorbits little-backup-box versions prior to f39f91c Description: The issue allows remote attackers to execute arbitrary code because the PHP extract function is used for untrusted input. This is due to insufficient validation of input dat...

OESA-2023-1965 jettison security update

Jettison is a collection of Java APIs like STaX and DOM which read and write JSON. This allows nearly transparent enablement of JSON based web services in services frameworks like CXF or XML serialization frameworks like XStream. Security Fixes: Those using Jettison to parse untrusted XML or JSON...

gstreamer: MXF demuxer use-after-free vulnerability

A use-after-free flaw was found in the MXF demuxer in GStreamer when handling certain MXF video files. This issue could allow a malicious third party to trigger a crash in the application and may allow code execution...

PT-2023-31625 · Resque · Resque

Name of the Vulnerable Software and Affected Versions: Resque versions prior to 2.6.0 Description: A reflected XSS issue occurs when the /queues endpoint is appended with malicious input, such as ". This allows for cross-site scripting attacks. The estimated number of potentially affected devices...

OESA-2023-1924 hsqldb security update

HSQLdb is a relational database engine written in JavaTM , with a JDBC driver, supporting a subset of ANSI-92 SQL. It offers a small about 100k, fast database engine which offers both in memory and disk based tables. Embedded and server modes are available. Additionally, it includes tools such as...

IBM Informix Dynamic Server Buffer Overflow Vulnerability (CNVD-2023-9769466)

IBM Informix Dynamic Server IDS is a scalable object-relational database server from International Business Machines IBM that provides clustered data centers with features such as continuous data availability and disaster recovery. IBM Informix Dynamic Server suffers from a buffer overflow...

IBM Informix Dynamic Server 缓冲区错误漏洞

IBM Informix Dynamic Server IDS is a scalable object-relational database server from International Business Machines IBM that provides clustered data centers with features such as continuous data availability and disaster recovery. IBM Informix Dynamic Server suffers from a buffer overflow...

Structured Content < 1.6 - Contributor+ PHP Object Injection

Description The plugin is vulnerable to PHP Object Injection via deserialization of untrusted input. This makes it possible for attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an...

NETGEAR RBR750 安全漏洞

The NETGEAR RBR750 is a home WiFi system from NETGEAR. A buffer overflow vulnerability exists in the NETGEAR RBR750 prior to version V7.2.6.21, which originates from a boundary error in /usr/sbin/httpd when handling untrusted input. A remote attacker could exploit this vulnerability to execute...

dev-java/snakeyaml: DoS via stack overflow

Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack...

Squid buffer overflow vulnerability (CNVD-2023-9750097)

Squid is a suite of proxy server and web caching server software. The software provides features such as caching the World Wide Web, filtering traffic, and proxying the Internet. Squid suffers from a buffer overflow vulnerability that originates from a boundary error when the application processe...