12770 matches found
OESA-2023-1725 glibc security update
The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational...
F5 Networks BIG-IP : BIG-IP and BIG-IQ DB Variable Vulnerability (K20850144)
The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.0 / 16.1.4 / 15.1.9. It is, therefore, affected by a vulnerability as referenced in the K20850144 advisory. The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database DB variables. Not...
CVE-2023-31192: Use of Uninitialized Variable
An information disclosure vulnerability exists in the ClientConnect functionality of SoftEther VPN 5.01.9674. A specially crafted network packet can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...
SoftEther VPN CiRpcAccepted() authentication bypass vulnerability
Talos Vulnerability Report TALOS-2023-1754 SoftEther VPN CiRpcAccepted authentication bypass vulnerability October 12, 2023 CVE Number CVE-2023-27516 SUMMARY An authentication bypass vulnerability exists in the CiRpcAccepted functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A specially...
CVE-2023-26370 ZDI-CAN-21257: Adobe Photoshop PSD File Parsing Uninitialized Variable Remote Code Execution Vulnerability
Adobe Photoshop versions 23.5.5 and earlier and 24.7 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a...
Adobe Photoshop PSD File Parsing Uninitialized Variable Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Photoshop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSD...
CVE-2023-41964 BIG-IP and BIG-IQ Database Variable vulnerability
The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database DB variables. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
CVE-2023-41964 BIG-IP and BIG-IQ Database Variable vulnerability
The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database DB variables. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
PT-2023-36348 · Unknown · Graphql Mesh
Name of the Vulnerable Software and Affected Versions: GraphQL Mesh affected versions not specified Description: GraphQL Mesh is a framework and gateway for GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, and databases. When a user transforms on the root level or...
GO-2023-2098 Unsoundness in variable comparison / non-unique binary decomposition in github.com/consensys/gnark
Unsoundness in variable comparison / non-unique binary decomposition in github.com/consensys/gnark...
CVE-2022-3431
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable...
Design/Logic Flaw
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable...
CVE-2022-3431
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable...
CVE-2023-44378 gnark vulnerable to unsoundness in variable comparison/non-unique binary decomposition
gnark is a zk-SNARK library that offers a high-level API to design circuits. Prior to version 0.9.0, for some in-circuit values, it is possible to construct two valid decomposition to bits. In addition to the canonical decomposition of a, for small values there exists a second decomposition for a...
Denial Of Service (DoS)
binutils is vulnerable to Denial of Service DoS. An use of an uninitialized variable causes a logic fail in the bfdinitsectiondecompressstatus function, which may allow a local attacker to cause an application crash...
Node.js: insecure loading of ICU data through ICU_DATA environment variable
An untrusted search path vulnerability exists in Node.js. 19.6.1, 18.14.1, 16.19.1, and 14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges...
CVE-2022-3431: Incorrect Default Permissions
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable...
Out-of-bounds Read
grub2 is vulnerable to Out-of-bounds Read. The vulnerability allows an attacker to read arbitrary memory locations, including sensitive data such as cached passwords and EFI variable values, by presenting a specially crafted NTFS filesystem image...
Denial Of Service (DoS)
libjson-c.so is vulnerable to Denial Of Service DoS. The vulnerability exists due to a buffer overflow because the sizet variable is not properly validated which allows an attacker to cause an application crash by entering a value that overflows the int type...
SUSE CVE-2023-4911
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBCTUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBCTUNABLES environment variables when launching binaries with SUID permission to execute code...