3574 matches found
CVE-2023-41061
A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited...
CVE-2023-41061
CVE-2023-41061 is an Apple Wallet code execution vulnerability tied to parsing of PassKit attachments. The CVE’s context in the provided sources shows exploitation potential via a malicious PassKit attachment containing crafted images (notably WebP/MakerNote data) that triggers a heap/grooming se...
About the security content of watchOS 9.6.2
About the security content of watchOS 9.6.2 This document describes the security content of watchOS 9.6.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...
VulnCheck KEV: CVE-2023-41061
Apple iOS, iPadOS, and watchOS contain an unspecified vulnerability due to a validation issue affecting Wallet in which a maliciously crafted attachment may result in code execution. This vulnerability was chained with CVE-2023-41064...
The software for creating, monitoring, and orchestrating data processing scenarios in Airflow is vulnerable due to insufficient validation of input data. This vulnerability allows attackers to trigger service failures.
The software used for creating, monitoring, and orchestrating data processing scenarios in Airflow is vulnerable due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...
CVE-2023-28188
A denial-of-service issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3. A remote user may be able to cause a denial-of-service...
Zero Redemption Amount in RdpxDecayingBonds Contract
Lines of code Vulnerability details Impact The redeem function, as described, checks whether the assets to be redeemed assets are not zero. This check is in place to ensure that a user isn't redeeming a non-zero amount of rdpxAmount tokens in exchange for zero assets. Such a check is essential to...
CVE-2023-28567 Improper Validation of Array Index in WLAN HAL
Memory corruption in WLAN HAL while handling command through WMI interfaces...
CVE-2023-28548 Improper Validation of Array Index in WLAN HAL
Memory corruption in WLAN HAL while processing Tx/Rx commands from QDART...
PT-2023-22931 · Samsung · Samsung Email
Name of the Vulnerable Software and Affected Versions: Samsung Email versions prior to 6.1.82.0 Description: The issue allows a remote attacker to intercept network traffic, including sensitive information, due to improper certificate validation. Recommendations: For versions prior to 6.1.82.0,...
PT-2023-24045 · Unknown · Gnss Service
Name of the Vulnerable Software and Affected Versions: gnss service affected versions not specified Description: The issue is related to a possible out of bounds read in the gnss service due to improper input validation. This could lead to local information disclosure, requiring System execution...
PT-2023-6523 · Apache · Apache Nifi Minifi C++
Name of the Vulnerable Software and Affected Versions: Apache NiFi MiNiFi C++ versions 0.13 through 0.14 Description: The issue is related to incorrect certificate validation in the InvokeHTTP component, allowing an intermediary to present a forged certificate during TLS handshake negotiation. Th...
PT-2023-27760 · Unknown · @Dcl/Single-Sign-On-Client
Name of the Vulnerable Software and Affected Versions: @dcl/single-sign-on-client versions prior to 0.1.0 Description: The issue concerns improper input validation in the init function, allowing arbitrary JavaScript to be executed using the javascript: prefix. This can be exploited by passing...
PT-2023-5317 · Acronis · Acronis Cloud Manager
Name of the Vulnerable Software and Affected Versions: Acronis Cloud Manager Windows versions before 6.2.23089.203 Description: The issue is related to remote command execution due to improper input validation. This allows a remote attacker to execute arbitrary commands. Recommendations: For...
Microsoft Excel SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Excel. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP...
PT-2023-26671 · Unknown · Online Shopping Portal Project
Name of the Vulnerable Software and Affected Versions: Online Shopping Portal Project version 3.1 Description: The issue allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This arises due to...
PDF-XChange Editor TIF File Parsing Use-After-Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of...
PT-2023-4622 · Unknown · Tn-5900 Series +1
Name of the Vulnerable Software and Affected Versions: TN-4900 Series firmware versions v1.2.4 and prior TN-5900 Series firmware versions v3.3 and prior Description: The issue stems from insufficient input validation in the certificate-generation function, which could potentially allow malicious...
CVE-2023-39949 Improper validation of sequence numbers leading to remotely reachable assertion failure
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.9.1 and 2.6.5, improper validation of sequence numbers may lead to remotely reachable assertion failure. This can remotely crash any Fast-DDS process. Versions...