Archive
24 March 2023
Vulnerabilities first published on this day (UTC), newest first.
75 results · Clear filters · Feed
-
Medium 6.5
TensorFlow vulnerable to segfault when opening multiframe gif
TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, integer overflow occurs when `2^31 <= num_frames * height * width * channels < 2^32`, for example Full HD screencast of at least 346 frames. A fix is included in …
-
Medium —
`openssl` `X509NameBuilder::build` returned object is not thread safe
OpenSSL has a `modified` bit that it can set on on `X509_NAME` objects. If this bit is set then the object is not thread-safe even when it appears the code is not modifying the value. Thanks to David Benjamin (Google) for reporting this issue.
-
Medium —
async-nats vulnerable to TLS certificate common name validation bypass
The NATS official Rust clients are vulnerable to MitM when using TLS. The common name of the server's TLS certificate is validated against the `host`name provided by the server's plaintext `INFO` message during the initial connection setup phase. A MitM proxy…
-
Medium 6.5
Dataease file upload interface does not verify permission or file type
Dataease is an open source data visualization and analysis tool. The permissions for the file upload interface is not checked so users who are not logged in can upload directly to the background. The file type also goes unchecked, users could upload any type …
-
Medium 5.7
Versionize is lacking bound checks, potentially leading to out of bounds memory access
Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times and minimal size overhead. An issue was discovered in the ‘Versionize::deserialize’ implementation p…
-
Medium 5.7
Rapid7 InsightVM Insufficient Session Expiration
Rapid7 InsightVM suffers from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential lea…
-
Medium 5.5
An issue was discovered in the Linux kernel before 5.8. lib/nlattr.c allows attackers to cause a denial of service (unb…
-
Medium 5.3
Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store vi…
-
Medium 5.3
An issue was discovered in Independentsoft JSpreadsheet before 1.1.110. The API is prone to XML external entity (XXE) i…
-
Medium 5.3
An issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0. The application upgrade process included un…
-
Medium 5.3
An issue was discovered in Independentsoft JWord before 1.1.110. The API is prone to XML external entity (XXE) injectio…
-
Medium 5.3
An issue was discovered in Independentsoft JODF before 1.1.110. The API is prone to XML external entity (XXE) injection…
-
Medium 5.5
A NULL pointer dereference was found in io_file_bitmap_get in io_uring/filetable.c in the io_uring sub-component in the…
-
Medium 5.3
Absolute Path Traversal in mlflow/mlflow
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2.
-
Medium 6.5
Faveo 5.0.1 allows remote attackers to obtain sensitive information via a modified user ID in an Insecure Direct Object…
-
Medium 5.4
SourceCodester Loan Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the…
-
Medium 4.4
In _ufdt_output_node_to_fdt of ufdt_convert.c, there is a possible out of bounds read due to a heap buffer overflow. Th…
-
Medium 6.7
In lwis_slc_buffer_free of lwis_device_slc.c, there is a possible memory corruption due to type confusion. This could l…
-
Medium 4.4
In ConvertToHalMetadata of aidl_utils.cc, there is a possible out of bounds read due to an incorrect bounds check. This…
-
Medium 6.7
In (TBD) of (TBD), there is a possible way to corrupt memory due to a use after free. This could lead to local escalati…
-
Medium 6.7
In load_png_image of ExynosHWCHelper.cpp, there is a possible out of bounds write due to improper input validation. Thi…
-
Medium 4.4
In multiple locations of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This coul…
-
Medium 6.7
In UnwindingWorker of unwinding.cc, there is a possible out of bounds write due to a use after free. This could lead to…
-
Medium 6.7
In setToExternal of ril_external_client.cpp, there is a possible out of bounds write due to a missing bounds check. Thi…
-
Medium 6.4
In dit_hal_ioctl of dit.c, there is a possible use after free due to a race condition. This could lead to local escalat…
-
Medium 6.7
In dwc3_exynos_clk_get of dwc3-exynos.c, there is a possible out of bounds write due to an incorrect bounds check. This…
-
Medium 4.4
In forceStaDisconnection of hostapd.cpp, there is a possible out of bounds read due to a missing bounds check. This cou…
-
Medium 5.5
In AccountTypePreference of AccountTypePreference.java, there is a possible way to mislead the user about accounts inst…
-
Medium 6.7
In registerSignalHandlers of main.c, there is a possible local arbitrary code execution due to a use after free. This c…
-
Medium 4.4
In ConvertToHalMetadata of aidl_utils.cc, there is a possible out of bounds read due to a missing bounds check. This co…
-
Medium 5.5
In ih264e_init_proc_ctxt of ih264e_process.c, there is a possible out of bounds read due to a heap buffer overflow. Thi…
-
Medium 6.7
In rtt_unpack_xtlv_cbfn of dhd_rtt.c, there is a possible out of bounds write due to a heap buffer overflow. This could…
-
Medium 4.4
When cpif handles probe failures, there is a possible out of bounds read due to a use after free. This could lead to lo…
-
Medium 4.4
In append_camera_metadata of camera_metadata.c, there is a possible out of bounds read due to a missing bounds check. T…
-
Medium 6.7
In cs40l2x_cp_trigger_queue_show of cs40l2x.c, there is a possible out of bounds write due to a use after free. This co…
-
Medium 5.5
In register of UidObserverController.java, there is a missing permission check. This could lead to local information di…
-
Medium 4.4
In multiple locations of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This coul…
-
Medium 4.4
In multiple locations of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This coul…
-
Medium 4.4
In ufdt_local_fixup_prop of ufdt_overlay.c, there is a possible out of bounds read due to an incorrect bounds check. Th…
-
Medium 5.1
In multiple locations of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This coul…