Linux kernel 安全漏洞

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. A security vulnerability exists in the Linux kernel that stems from a null pointer dereference due to an unchecked return value of kmemdup...

Hutool 缓冲区错误漏洞

Hutool is a small but complete Java tool library for the Chinese Dromara community. A security vulnerability exists in Hutool version v5.8.10, which originates from a stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component, allowing an attacker to cause a denial of servic...

Linux kernel 代码问题漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a failure to check the return value of kmalloc, resulting in a null pointer dereference...

PT-2022-7226 · Netty +5 · Netty +5

Name of the Vulnerable Software and Affected Versions: Netty versions 4.1.83.Final through 4.1.85.Final Netty versions prior to 4.1.86.Final Description: The Netty project is an event-driven asynchronous network application framework. When calling DefaultHttpHeaders.set with an iterator of values...

Value can be extracted from LPs

Lines of code Vulnerability details Impact Maverick allow liquidity to be moved based on TWAP to increase capital efficiency. However, the increased capital efficiency is not free. Consider a "right" move, the LP sell at lower price and move their liquidity to higher price, thus buying at higher...

PT-2022-27057 · Unknown +1 · Ticklishhoneybee Nodau +1

Name of the Vulnerable Software and Affected Versions: TicklishHoneyBee nodau affected versions not specified Description: A critical issue was found in TicklishHoneyBee nodau, affecting some unknown functionality of the file src/db.c. The manipulation of the value/name argument leads to sql...

libxml2: integer overflows with XML_PARSE_HUGE

A flaw was found in libxml2. Parsing a XML document with the XMLPARSEHUGE option enabled can result in an integer overflow because safety checks were missing in some functions. Also, the xmlParseEntityValue function didn't have any length limitation...

Unchecked Return Value

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Unchecked Return Value due to failing to check the return value from xmlTextReaderExpand in the method Nokogiri::XML::Readerattributehash. Exploiting this vulnerability can lead ...

CVE-2022-23476 Unchecked return value from xmlTextReaderExpand in Nokogiri

Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri 1.13.8 and 1.13.9 fail to check the return value from xmlTextReaderExpand in the method Nokogiri::XML::Readerattributehash. This can lead to a null pointer exception when invalid markup is being parsed. Fo...

GSD-2022-1007760 io_uring: calculate CQEs from the user visible value

iouring: calculate CQEs from the user visible value This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.10 by commit...

PT-2025-49704

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.0-rc3-next 370 Description A use-after-free issue exists in the ext4 filesystem's orphan inode cleanup routine. Specifically, when the ext4 inode attach jinode function fails with -ENOMEM during orphan cleanu...

python-ujson: improper decoding of escaped surrogate characters may lead to string corruption, key confusion or value overwriting

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupti...

jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS

A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAPSINGLEVALUEARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting...

Design/Logic Flaw

Passeo is an open source python password generator. Versions prior to 1.0.5 rely on the python random library for random value selection. The python random library warns that it should not be used for security purposes due to its reliance on a non-cryptographically secure random number generator...

CVE-2022-44009

Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, allowing attackers to access K/V pairs of other users, potentially leading to the exposure of sensitive Information...

Improper access control

Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, allowing attackers to access K/V pairs of other users, potentially leading to the exposure of sensitive Information...

NVIDIA D3D10 Driver Shader Functionality DCL_INDEXRANGE instruction memory corruption vulnerability

Talos Vulnerability Report TALOS-2022-1604 NVIDIA D3D10 Driver Shader Functionality DCLINDEXRANGE instruction memory corruption vulnerability December 6, 2022 CVE Number CVE-2022-34671 SUMMARY A memory corruption vulnerability exists in the Shader Functionality DCLINDEXRANGE instruction...

StackStorm 安全漏洞

StackStorm is an event-driven automation platform. The platform is used for automated remediation, security response, troubleshooting and program deployment functions. A security vulnerability exists in StackStorm version 3.7.0, which stems from improper Key-Value RBAC access control that fails t...

nadesiko3 allows remote attacker to inject invalid value to decodeURIComponent of nako3edit

Nako3edit is the editor component of Nadeshiko 3, a programming language developed based on Japanese. Improper check or handling of exceptional conditions in Nako3edit v3.3.74 and earlier allows a remote attacker to inject an invalid value to decodeURIComponent of nako3edit, which may lead the...

Input validation

Improper check or handling of exceptional conditions vulnerability in Nako3edit, editor component of nadesiko3 PC Version v3.3.74 and earlier allows a remote attacker to inject an invalid value to decodeURIComponent of nako3edit, which may lead the server to crash...