6696 matches found
chromium -- multiple security fixes
Chrome Releases reports: This update includes 3 security fixes: 377384894 High CVE-2024-11395: Type Confusion in V8. Reported by Anonymous on 2024-11-05...
Gitlab -- vulnerabilities
Gitlab reports: Unauthorized access to Kubernetes cluster agent Device OAuth flow allows for cross window forgery Denial of Service by importing malicious crafted FogBugz import payload Stored XSS through javascript URL in Analytics dashboards HTML injection in vulnerability Code flow could lead ...
electron32 -- multiple vulnerabilities
Electron developers report: This update fixes the following vulnerabilities: Security: backported fix for CVE-2024-7966. Security: backported fix for CVE-2024-9370...
vscode -- Visual Studio Code for Linux Remote Code Execution Vulnerability
VSCode developers report: Visual Studio Code for Linux Remote Code Execution Vulnerability A remote code execution vulnerability exists in VS Code 1.94.0 and earlier versions in the elevated save flow...
SnappyMail -- multiple mXSS in HTML sanitizer
Oskar reports: SnappyMail uses the cleanHtml function to cleanup HTML and CSS in emails. Research discovered that the function has a few bugs which cause an mXSS exploit. Because the function allowed too many invalid HTML elements, it was possible with incorrect markup to trick the browser to "fi...
Intel CPUs -- multiple vulnerabilities
Intel reports: A potential security vulnerability in some 4th and 5th Generation Intel Xeon Processors may allow denial of service. Intel released microcode updates to mitigate this potential vulnerability. Potential security vulnerabilities in some Intel Xeon processors using Intel Software Guar...
traefik -- Azure Identity Libraries Elevation of Privilege Vulnerability
The traefik authors report: There is a vulnerability in Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability...
minio -- unintentional information disclosure
Minio security advisory GHSA-95fr-cm4m-q5p9 reports: when used with anonymous requests by sending a random object name requests you can figure out if the object exists or not on the server on a specific bucket and also gain access to some amount of information...
electron{27,28} -- Out of bounds memory access in V8
Electron developers report: This update fixes the following vulnerability: Security: backported fix for CVE-2024-3159...
electron{27,28} -- Out of bounds memory access in V8
Electron developers report: This update fixes the following vulnerability: Security: backported fix for CVE-2024-2173...
QtNetwork -- potential buffer overflow
Andy Shaw reports: A potential integer overflow has been discovered in Qt's HTTP2 implementation. If the HTTP2 implementation receives more than 4GiB in total headers, or more than 2GiB for any given header pair, then the internal buffers may overflow...
Grafana -- Email verification is not required after email change
Grafana Labs reports: The vulnerability impacts instances where Grafana basic authentication is enabled. Grafana has a verifyemailenabled configuration option. When this option is enabled, users are required to confirm their email addresses before the sign-up process is complete. However, the ema...
squid -- Multiple vulnerabilities
The squid-cache project reports: Denial of Service in FTP Request/Response smuggling in HTTP/1.1 and ICAP Denial of Service in HTTP Digest Authentication...
jenkins -- Stored XSS vulnerability
Jenkins Security Advisory: Description High SECURITY-3188 / CVE-2023-39151 Stored XSS vulnerability...
libsndfile_project -- Integer overflow in dataend calculation
[email protected] reports: Multiple signed integers overflow in function aureadheader in src/au.c and in functions mat4open and mat4readheader in src/mat4.c in Libsndfile, allows an attacker to cause Denial of Service or other unspecified impacts...
GLPI vulnerable to SQL injection via inventory agent request
[email protected] reports: GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.8, GLPI inventory endpoint can be used to drive a SQL injection attack. By default, GLPI inventory endpoint requires no authentication. Version...
Kanboard -- Clipboard based cross-site scripting (blocked with default CSP) in Kanboard
[email protected] reports: Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements under the contentEditable element, maliciously crafted clipboard content can inject arbitrary HTML tags into the DOM. A low-privileged...
h2o -- Malformed HTTP/1.1 causes Out-of-Memory Denial of Service
Elijah Glover reports: Malformed HTTP/1.1 requests can crash worker processes. occasionally locking up child workers and causing denial of service, and an outage dropping any open connections...
mod_gnutls -- Infinite Loop on request read timeout
The modgnutls project reports: Modgnutls is a TLS module for Apache HTTPD based on GnuTLS. Versions from 0.9.0 to 0.12.0 including did not properly fail blocking read operations on TLS connections when the transport hit timeouts. Instead it entered an endless loop retrying the read operation,...
rxvt-unicode is vulnerable to a remote code execution
Marc Lehmann reports: The biggest issue is resolving CVE-2022-4170, which allows command execution inside urxvt from within the terminal that means anything that can output text in the terminal can start commands in the context of the urxvt process, even remotely...
FreeBSD -- AIO credential reference count leak
Problem Description: The aioaqueue function, used by the liolistio system call, fails to release a reference to a credential in an error case. Impact: An attacker may cause the reference count to overflow, leading to a use after free UAF...
Plex Media Server -- security vulnerability
Plex Security Team reports: We have recently been made aware of a security vulnerability in Plex Media Server versions prior to 1.25.0 that could allow a local Windows user to obtain administrator privileges without authorization. To be clear, this required the user to already have local, physica...
Pillow -- Regular Expression Denial of Service (ReDoS)
GitHub Advisory Database reports: Uncontrolled Resource Consumption in pillow. The package pillow from 0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service ReDoS via the getrgb function. References: https://nvd.nist.gov/vuln/detail/CVE-2021-23437...
dragonfly -- argument injection
NVD reports: An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verifyurl option is disabled. This may lead to code execution. The problem occurs because the generate and process...
nomad -- multiple vulnerabilities
The HashiCorp team reports: artifact: Fixed a bug where interpolation can be used in the artifact destination field to write artifact payloads outside the allocation directory. template: Fixed a bug where interpolation can be used in the template source and destination fields to read or write fil...
powerdns -- Various issues in GSS-TSIG support
PowerDNS developers report: A remote, unauthenticated attacker can trigger a race condition leading to a crash, or possibly arbitrary code execution, by sending crafted queries with a GSS-TSIG signature. A remote, unauthenticated attacker can cause a denial of service by sending crafted queries...
FreeBSD -- kernel stack data disclosure
Problem Description: Due to incorrect initialization of a stack data structure, up to 20 bytes of kernel data stored previously stored on the stack will be exposed to a crashing user process. Impact: Sensitive kernel data may be disclosed...
FreeBSD -- Insufficient cryptodev MAC key length check
Problem Description: Requests to create cryptography sessions using a MAC did not validate the user-supplied MAC key length. The cryptodev module allocates a buffer whose size is this user-suppled length. Impact: An unprivileged process can trigger a kernel panic...
Mbed TLS -- Side channel attack on deterministic ECDSA
Janos Follath reports: Mbed TLS does not have a constant-time/constant-trace arithmetic library and uses blinding to protect against side channel attacks. In the ECDSA signature routine previous Mbed TLS versions used the same RNG object for generating the ephemeral key pair and for generating th...
wordpress -- multiple issues
wordpress developers reports: Props to Simon Scannell of RIPS Technologies for finding and disclosing two issues. The first, a cross-site scripting XSS vulnerability found in post previews by contributors. The second was a cross-site scripting vulnerability in stored comments. Props to Tim Coen f...
FreeBSD -- Reference count overflow in mqueue filesystem 32-bit compat
Problem Description: System calls operating on file descriptors obtain a reference to relevant struct file which due to a programming error was not always put back, which in turn could be used to overflow the counter of affected struct file. Impact: A local user can use this flaw to obtain access...
gitea -- multiple vulnerabilities
Gitea Team reports: This release contains two new security fixes which cannot be backported to the 1.7.0 branch, so it is recommended to update to this version...
tcpreplay -- Multiple vulnerabilities
fklassen on Github reports: This release fixes the following security issues: memory access in dochecksum NULL pointer dereference getlayer4v6 NULL pointer dereference getipv6l4proto...
drupal -- Drupal core - Arbitrary PHP code execution
Drupal Security Team reports: A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code core, contrib, and custom may be performing file operations on insufficiently validated user input, thereb...
wesnoth -- Code Injection vulnerability
shadowm reports: A severe bug was found in the game client which could allow a malicious user to execute arbitrary code through the Lua engine by using specially-crafted code in add-ons, saves, replays, or networked games. This issue affects all platforms and all existing releases since Wesnoth...
Bugzilla security issues
Bugzilla Security Advisory A CSRF vulnerability in report.cgi would allow a third-party site to extract confidential information from a bug the victim had access to...
consul -- vulnerability in embedded DNS library
Consul developers report: A flaw was found in the embedded DNS library used in consul which may allow a denial of service attack. Consul was updated to include the fixed version...
libXcursor -- integer overflow that can lead to heap buffer overflow
The freedesktop.org project reports: It is possible to trigger heap overflows due to an integer overflow while parsing images and a signedness issue while parsing comments. The integer overflow occurs because the chosen limit 0x10000 for dimensions is too large for 32 bit systems, because each...
cyrus-imapd -- broken "other users" behaviour
Cyrus IMAP 3.0.4 Release Notes states: Fixed Issue 2132: Broken "Other Users" behaviour...
ledger -- multiple vulnerabilities
Talos reports: An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause an integer underflow resulting in code execution. An attacker can construct a malicious journal file to trigger this vulnerability. A...
asterisk -- Remote Crash Vulerability in res_pjsip
The Asterisk project reports: A carefully crafted URI in a From, To or Contact header could cause Asterisk to crash...
rubygems -- multiple vulnerabilities
Official blog of RubyGems reports: The following vulnerabilities have been reported: a DNS request hijacking vulnerability, an ANSI escape sequence vulnerability, a DoS vulnerability in the query command, and a vulnerability in the gem installer that allowed a malicious gem to overwrite arbitrary...
asterisk -- Crash on SDP offer or answer from endpoint using Opus
The Asterisk project reports: If an SDP offer or answer is received with the Opus codec and with the format parameters separated using a space the code responsible for parsing will recursively call itself until it crashes. This occurs as the code does not properly handle spaces separating the...
irssi -- heap corruption and missing boundary checks
Irssi reports: Remote crash and heap corruption. Remote code execution seems difficult since only Nuls are written...
libtorrent-rasterbar -- denial of service
Brandon Perry reports: The parsechunkheader function in libtorrent before 1.1.1 allows remote attackers to cause a denial of service crash via a crafted 1 HTTP response or possibly a 2 UPnP broadcast...
p7zip -- out-of-bounds read vulnerability
Cisco Talos reports: An out-of-bounds read vulnerability exists in the way 7-Zip handles Universal Disk Format UDF files. Central to 7-Zip’s processing of UDF files is the CInArchive::ReadFileItem method. Because volumes can have more than one partition map, their objects are kept in an object...
openafs -- multiple vulnerabilities
The OpenAFS development team reports: Foreign users can bypass access controls to create groups as system:administrators, including in the user namespace and the system: namespace. The contents of uninitialized memory are sent on the wire when clients perform certain RPCs. Depending on the RPC, t...
ricochet -- information disclosure
special reports: By sending a nickname with some HTML tags in a contact request, an attacker could cause Ricochet to make network requests without Tor after the request is accepted, which would reveal the user's IP address...
kibana4 -- CSRF vulnerability
Elastic reports: Vulnerability Summary: Kibana versions prior to 4.1.3 and 4.2.1 are vulnerable to a CSRF attack. Remediation Summary: Users should upgrade to 4.1.3 or 4.2.1...