32226 matches found
msgpack5: Decoding negative int64 values mutates the input buffer
...
msgpack5: Many buffered values can exhaust the streaming decoder stack
...
msgpack5: Reserved byte can cause unbounded stream buffering
...
msgpack5: Truncated map32 headers throw an unexpected error
...
msgpack5: Quadratic parsing in the streaming decoder
...
MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()
...
MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC
...
AdonisJS: Unencoded route parameters can produce open redirects
...
Out-of-bounds read vulnerability in Context2D.path and PathSvg.path properties impacts Qt Quick
...
Denial-of-service (stack-exhaustion) vulnerability in QXmlStreamReader::readElementText() impacts Qt
...
Malformed LLB file operation can crash buildkitd
...
Cache poisoning via unvalidated image layer DiffIDs
...
Malformed MergeOp can crash the BuildKit daemon
...
Crafted Git build source can bypass certain policy validation
...
A malicious frontend can cause a daemon panic
...
BuildKit improperly handles special files in build snapshots
...
libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header() when parsing crafted MAT4 (MATLAB v4) files.
...
libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing WAV fmt chunks. A specially crafted WAV file can cause the function to cast an unaligned destination address to unsigned int * and perform a 4-byte store. This results in undefined behavior leading to denial of service.
...
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.
...
Apache HTTP Server: mod_proxy_html: crash in dump_content
...
Apache HTTP Server: mod_dav_fs property database read access
...
Apache HTTP Server: mod_heartmonitor denial of service
...
Apache HTTP Server: mod_auth_digest DoS attack
...
Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function
...
Apache HTTP Server: mod_proxy_ftp PASV address handling
...
Apache HTTP Server: mod_userdir information disclosure
...
Apache HTTP Server: mod_dav shared lock overflow
...
Apache HTTP Server: mod_auth_digest reauthentication attack
...
Apache HTTP Server: mod_session: Session cookie not removed during internal redirect
...
Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}
...
Apache HTTP Server: mod_dav_fs namespace overflow
...
Apache HTTP Server: mod_auth_digest one-time-nonce replay attack
...
Apache HTTP Server: mod_xml2enc crash on charset conversion failure
...
Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories
...
Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char
...
Oversized Dockerfile or .dockerignore can exhaust buildkitd memory
...
Cups: cups: argument injection in mailto notifier via notify-recipient-uri
...
Busybox: busybox: dpkg read_package_field() steps past nul terminator, causing out-of-bounds read on malformed .deb packages
...
tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
...
libexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBuffer
...
Microsoft Partner Center Elevation of Privilege Vulnerability
Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network...
Microsoft Bookings Elevation of Privilege Vulnerability
Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network...
Azure SRE Agent Elevation of Privilege Vulnerability
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network...
Microsoft Dataverse Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network...
Azure App Service Remote Code Execution Vulnerability
Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network...
Azure Event Grid Spoofing Vulnerability
Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network...
Azure API Center Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclose information over a network...
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
...