3435 matches found
Oracle Linux 8 : firefox (ELSA-2023-0288)
The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-0288 advisory. 102.7.0-1.0.1 - Updated homepages to use https Orabug: 34648274 - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the...
Mozilla: Arbitrary file read from GTK drag and drop on Linux
The Mozilla Foundation Security Advisory describes this flaw as: Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to DataTransfer.setData...
CVE-2023-23598
The Mozilla Foundation Security Advisory describes this flaw as: Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to DataTransfer.setData...
jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS
A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAPSINGLEVALUEARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting...
oznetmaster SSharpSmartThreadPool: Race condition vulnerability
SSharpSmartThreadPool is a secondary wrapper component for ThreadPool by oznetmaster Personal Developer. The oznetmaster SSharpSmartThreadPool is vulnerable to a contention condition issue. An attacker exploits this vulnerability to cause two threads to rely on the order or timing of the appearan...
PT-2023-34581
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.163 Description A refcount leak was discovered in the pci get dev wrapper function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...
PT-2023-33909
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v6.0.16 Description The issue is related to a refcount leak in the pci get dev wrapper function. It was introduced in version v5.1 and fixed in version v6.0.16. The actual impact and attack plausibility have not...
PT-2023-1316
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 109 Thunderbird versions prior to 102.7 Firefox ESR versions prior to 102.7 Description The issue arises from the Firefox GTK wrapper code's use of text/plain for drag data, which GTK treats as being dragged if the...
com.canoo.dolphin-platform:dolphin-platform-security-client (>=1.0.0.cr4, <=1.0.0.cr5), com.canoo.dolphin-platform:dolphin-platform-security-server (>=1.0.0.cr4, <=1.0.0.cr5) +88 more potentially affected by CVE-2023-0091 via org.keycloak:keycloak-core (3.4.3.final)
org.keycloak:keycloak-core MAVEN version 3.4.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.canoo.dolphin-platform:dolphin-platform-security-client =1.0.0.cr4, =1.0.0.cr4, =1.0.0.cr4,...
GHSA-7VCX-V65Q-9WPG XML-RPC for PHP's `Wrapper::buildClientWrapperCode` method allows code injection via malicious `$client` argument
In order for this weakness to be exploited, the following conditions have to apply, at the same time: - method Wrapper::buildClientWrapperCode, or any methods which depend on it, such as Wrapper::wrapXmlrpcServer, Wrapper::wrapXmlrpcMethod or Wrapper::buildWrapMethodSource must be in use. Note th...
XML-RPC for PHP's `Wrapper::buildClientWrapperCode` method allows code injection via malicious `$client` argument
In order for this weakness to be exploited, the following conditions have to apply, at the same time: - method Wrapper::buildClientWrapperCode, or any methods which depend on it, such as Wrapper::wrapXmlrpcServer, Wrapper::wrapXmlrpcMethod or Wrapper::buildWrapMethodSource must be in use. Note th...
PT-2023-32992 · Phpxmlrpc · Phpxmlrpc
Name of the Vulnerable Software and Affected Versions: phpxmlrpc affected versions not specified Description: The issue can be exploited when specific methods such as Wrapper::buildClientWrapperCode, Wrapper::wrapXmlrpcServer, Wrapper::wrapXmlrpcMethod, or Wrapper::buildWrapMethodSource are used...
Go 1.20 Cryptography
The first second release candidate of Go 1.20 is out!1 This is the first release I participated in as an independent maintainer, after leaving Google to become a professional Open Source maintainer. By the way, thats going great, and Im going to write more about it here soon! Im pretty happy with...
SQLite report about CVE-2023-32697
This is a bug in the SQLite JDBC library, which is a wrapper library that provides access to SQLite from Java. SQLite JDBC is created and maintained independently from SQLite. Despite the use of "SQLite" in the name, the SQLite JDBC library is not affiliated with the SQLite project in any way. Th...
CVE-2021-30134
php-mod/curl a wrapper of the PHP cURL extension before 2.3.2 allows XSS via the postfilepathupload.php key parameter and the POST data to postmultidimensional.php...
Important: Red Hat Security Advisory: Red Hat build of Eclipse Vert.x 4.3.4 security update
An update is now available for Red Hat build of Eclipse Vert.x. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more...
jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS
A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAPSINGLEVALUEARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting...
CVE-2021-32415
EXEMSI MSI Wrapper Versions prior to 10.0.50 and at least since version 6.0.91 will introduce a local privilege escalation vulnerability in installers it creates...
