A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted. As a result, some memory access could occur on memory regions that were previously freed. Once freed, a memory region can be reused for other allocations and any pr...
AFFECTED_PRODUCTS:
Red Hat Enterprise Linux,
Red Hat Enterprise Linux,
Fedoraproject Fedora
... (+1)
A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.
AFFECTED_PRODUCTS:
Red Hat Enterprise Linux,
Red Hat Enterprise Linux,
Fedoraproject Fedora
... (+2)
Laf is a cloud development platform. In the Laf version design, the log uses communication with k8s to quickly retrieve logs from the container without the need for additional storage. However, in version 1.0.0-beta.13 and prior, this interface does not verify the permissions of the pod, which allow...
AFFECTED_PRODUCTS:
Laf Laf,
Laf Laf,
Laf Laf
... (+80)
CubeFS is an open-source cloud-native file storage system. CubeFS prior to version 3.3.1 was found to leak users secret keys and access keys in the logs in multiple components. When CubeCS creates new users, it leaks the users secret key. This could allow a lower-privileged user with access to the l...
AFFECTED_PRODUCTS:
Linuxfoundation Cubefs
CubeFS is an open-source cloud-native file storage system. A vulnerability was found in CubeFS prior to version 3.3.1 that could allow users to read sensitive data from the logs which could allow them escalate privileges. CubeFS leaks configuration keys in plaintext format in the logs. These keys co...
AFFECTED_PRODUCTS:
Linuxfoundation Cubefs
CubeFS is an open-source cloud-native file storage system. Prior to version 3.3.1, CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to predict and/or guess the generated string an...
AFFECTED_PRODUCTS:
Linuxfoundation Cubefs
CubeFS is an open-source cloud-native file storage system. A vulnerability was found during in the CubeFS master component in versions prior to 3.3.1 that could allow an untrusted attacker to steal user passwords by carrying out a timing attack. The root case of the vulnerability was that CubeFS use...
AFFECTED_PRODUCTS:
Linuxfoundation Cubefs
TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's browser.
AFFECTED_PRODUCTS:
Tiny Tinymce
TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user's browser.
AFFECTED_PRODUCTS:
Tiny Tinymce
PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of
service vulnerability. An attacker may trigger the denial of service
condition by providing crafted data to the DecodeFromBytes or other
decoding mechanisms in PeterO.Cbor. Depending on the usage of the
library, an unauthenti...
AFFECTED_PRODUCTS:
Peteroupc Cbor
TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's browser.
AFFECTED_PRODUCTS:
Tiny Tinymce
Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthen...
AFFECTED_PRODUCTS:
Newtonsoft Json.net
CubeFS is an open-source cloud-native file storage system. A security vulnerability was found in CubeFS HandlerNode in versions prior to 3.3.1 that could allow authenticated users to send maliciously-crafted requests that would crash the ObjectNode and deny other users from using it. The root cause...
AFFECTED_PRODUCTS:
Linuxfoundation Cubefs
Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1, and 1.5.2, an attacker who has gained root privilege of the node that kruise-daemon run can leverage the kruise-daemon pod to list all secrets in the entire c...
AFFECTED_PRODUCTS:
Openkruise Kruise,
Openkruise Kruise,
Openkruise Kruise
An issue in Tamaki_hamanoki Line v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.
AFFECTED_PRODUCTS:
Linecorp Line
APIIDA API Gateway Manager for Broadcom Layer7 v2023.2.2 is vulnerable to Host Header Injection.
AFFECTED_PRODUCTS:
Apiida Api Gateway Manager
Directory Traversal in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 allows a remote attacker to obtain sensitive information via csvServer.php?file= with a .. in the dir parameter.
AFFECTED_PRODUCTS:
Automaticsystems Soc Fl9600 Firstlane Firmware
APIIDA API Gateway Manager for Broadcom Layer7 v2023.2 is vulnerable to Cross Site Scripting (XSS).
AFFECTED_PRODUCTS:
Apiida Api Gateway Manager
A host header injection vulnerability exists in the NPM package @perfood/couch-auth versions <= 0.20.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus...
AFFECTED_PRODUCTS:
Perfood Couchauth
An issue in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 allows a remote attacker to obtain sensitive information because there is an automaticsystems super admin account with astech as its hardcoded password.
AFFECTED_PRODUCTS:
Automaticsystems Soc Fl9600 Firstlane Firmware
The Product Expiry for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_settings' function in versions up to, and including, 2.5. This makes it possible for authenticated attackers, with subscriber-level permissions or...
AFFECTED_PRODUCTS:
Webcodingplace Product Expiry For Woocommerce
Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.9.0, the attackers can make a arbitrary file read attack using mysql driver. Users are advised to upgrade to Apache InLong's 1.10.0 or cherry-pick [1] to solve it.
[1]Â https://gi...
AFFECTED_PRODUCTS:
Apache Inlong
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.9.0, which could lead to Remote Code Execution. Users are advised to upgrade to Apache InLong's 1.10.0 or cherry-pick [1] to solve it.
[1] https://github....
AFFECTED_PRODUCTS:
Apache Inlong
The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on theprint_packinglist action in all versions up to, and including, 4.3.0. This makes it possible for authenticated att...
AFFECTED_PRODUCTS:
Webtoffee Woocommerce Pdf Invoices\, Packing Slips\, Delivery Notes And Shipping Labels
The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.13. This is due to missing or incorrect nonce validation in the powerpack-lite-for-elementor/classes/class-pp-admin-s...
AFFECTED_PRODUCTS:
Ideabox Powerpack Addons For Elementor
The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom attributes in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for contributors and above to inje...
AFFECTED_PRODUCTS:
Fooplugins Foogallery
The POST SMTP WordPress plugin before 2.8.7 does not sanitise and escape the msg parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
AFFECTED_PRODUCTS:
Wpexperts Post Smtp
PaddlePaddle before 2.6.0 has a command injection in convert_shape_compare. This resulted in the ability to execute arbitrary commands on the operating system.
AFFECTED_PRODUCTS:
Paddlepaddle Paddlepaddle
FPE in paddle.argmin and paddle.argmax in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
AFFECTED_PRODUCTS:
Paddlepaddle Paddlepaddle
Nullptr dereference in paddle.crop in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
AFFECTED_PRODUCTS:
Paddlepaddle Paddlepaddle
PaddlePaddle before 2.6.0 has a command injection in _wget_download. This resulted in the ability to execute arbitrary commands on the operating system.
AFFECTED_PRODUCTS:
Paddlepaddle Paddlepaddle
PaddlePaddle before 2.6.0 has a command injection in get_online_pass_interval. This resulted in the ability to execute arbitrary commands on the operating system.
AFFECTED_PRODUCTS:
Paddlepaddle Paddlepaddle
Heap buffer overflow in paddle.repeat_interleave in PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, information disclosure, or more damage is possible.
AFFECTED_PRODUCTS:
Paddlepaddle Paddlepaddle
FPE in paddle.amin in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
AFFECTED_PRODUCTS:
Paddlepaddle Paddlepaddle
Stack overflow in paddle.linalg.lu_unpack in PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, or even more damage.
AFFECTED_PRODUCTS:
Paddlepaddle Paddlepaddle
FPE in paddle.lerp in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
AFFECTED_PRODUCTS:
Paddlepaddle Paddlepaddle
FPE in paddle.topk in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
AFFECTED_PRODUCTS:
Paddlepaddle Paddlepaddle
Stack overflow in paddle.searchsorted in PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, or even more damage.
AFFECTED_PRODUCTS:
Paddlepaddle Paddlepaddle
Nullptr in paddle.put_along_axis in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
AFFECTED_PRODUCTS:
Paddlepaddle Paddlepaddle
Nullptr in paddle.nextafter in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
AFFECTED_PRODUCTS:
Paddlepaddle Paddlepaddle
An issue was discovered on GL.iNet devices through 4.5.0. Attackers can invoke the add_user interface in the system module to gain root privileges. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3....
AFFECTED_PRODUCTS:
Gl-Inet Gl Mt300n V2 Firmware,
Gl-Inet Gl Ax1800 Firmware,
Gl-Inet Gl Mt3000 Firmware
... (+9)
OOB access in paddle.mode in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
AFFECTED_PRODUCTS:
Paddlepaddle Paddlepaddle
FPE in paddle.linalg.eig in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
AFFECTED_PRODUCTS:
Paddlepaddle Paddlepaddle
Nullptr in paddle.dot in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
AFFECTED_PRODUCTS:
Paddlepaddle Paddlepaddle
FPE in paddle.linalg.matrix_rank in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
AFFECTED_PRODUCTS:
Paddlepaddle Paddlepaddle
FPE in paddle.nanmedian in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
AFFECTED_PRODUCTS:
Paddlepaddle Paddlepaddle
DOCSIS dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file
AFFECTED_PRODUCTS:
Wireshark Wireshark
Zigbee TLV dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file
AFFECTED_PRODUCTS:
Wireshark Wireshark
IEEE 1609.2 dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted capture file
AFFECTED_PRODUCTS:
Wireshark Wireshark,
Wireshark Wireshark,
Wireshark Wireshark
GVCP dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted capture file
AFFECTED_PRODUCTS:
Wireshark Wireshark,
Wireshark Wireshark,
Wireshark Wireshark