Archive
8 December 2023
Vulnerabilities first published on this day (UTC), newest first.
83 results · Feed
-
Medium 5.5
Kernel: io_uring out of boundary memory access in __io_uaddr_map()
An out-of-bounds memory access flaw was found in the io_uring SQ/CQ rings functionality in the Linux kernel. This issue could allow a local user to crash the system.
-
High 7.5
Server-Side Request Forgery in nuxt-api-party
`nuxt-api-party` is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforementioned attack. This has been recently changed to use the regular expression `^https?://`, however t…
-
High 7.5
Denial of service by abusing `fetchOptions.retry` in nuxt-api-party
`nuxt-api-party` is an open source module to proxy API requests. The library allows the user to send many options directly to `ofetch`. There is no filter on which options are available. We can abuse the retry logic to cause the server to crash from a stack o…
-
Medium 5.9
Duplicated execution of subcalls in OpenZeppelin Contracts
OpenZeppelin Contracts is a library for smart contract development. A merge issue when porting the 5.0.1 patch to the 4.9 branch caused a line duplication. In the version of `Multicall.sol` released in `@openzeppelin/contracts@4.9.4` and `@openzeppelin/contra…
-
Low —
eventing-gitlab vulnerable to denial of service, caused by improper enforcement of the timeout on individual read operations
### Impact The eventing-gitlab cluster-local server doesn't set `ReadHeaderTimeout` which could lead do a DDoS attack, where a large group of users send requests to the server causing the server to hang for long enough to deny it from being available to…
-
High 7.5
Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests
HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memor…
-
Unscored —
arm: Guests can trigger a deadlock on Cortex-A77
Cortex-A77 cores (r0p0 and r1p0) are affected by erratum 1508412 where software, under certain circumstances, could deadlock a core due to the execution of either a load to device or non-cacheable memory, and either a store exclusive or register read of the P…
-
High 8.0
Any image allowed by default
dockerspawner is a tool to spawn JupyterHub single user servers in Docker containers. Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying `DockerSpawner.allowed_images` configuration allow users to launch _any_ pullab…
-
High 7.1
Cross-Site-Scripting vulnerability in error message passing in richdocumentscode
Collabora Online is a collaborative online office suite based on LibreOffice technology. Users of Nextcloud with `Collabora Online - Built-in CODE Server` app can be vulnerable to attack via proxy.php. The bug was fixed in Collabora Online - Built-in CODE Ser…
-
High 7.2
Improper handling of browser-side provided input in richdocuments path handling
Collabora Online is a collaborative online office suite based on LibreOffice technology. Unlike a standalone dedicated Collabora Online server, the Built-in CODE Server (richdocumentscode) is run without chroot sandboxing. Vulnerable versions of the richdocum…
-
Medium 6.1
Groups not dropped before running subprocess when using empty 'extra_groups' parameter
An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the log…
-
Medium 5.5
Kernel: null pointer dereference vulnerability in nft_dynset_init()
A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service.
-
Medium 5.5
SourceCodester Simple Student Attendance System class_form.php sql injection
A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /modals/class_form.php. The manipulation of the argument id leads to sql injectio…
-
Medium 5.5
SourceCodester Simple Student Attendance System index.php file inclusion
A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument page leads to file inclus…
-
Medium 5.5
SourceCodester Simple Student Attendance System attendance.php sql injection
A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been classified as critical. Affected is an unknown function of the file attendance.php. The manipulation of the argument class_id leads to sql injection. The exploit has…
-
High 7.1
Kernel: oob access in smb2_dump_detail
An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
-
High 7.1
Kernel: out-of-bounds read vulnerability in smbcalcsize
An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
-
Low 3.5
SourceCodester Simple Student Attendance System index.php cross site scripting
A vulnerability was found in SourceCodester Simple Student Attendance System 1.0 and classified as problematic. This issue affects some unknown processing of the file index.php. The manipulation of the argument page leads to cross site scripting. The attack m…
-
Low 3.5
Typecho manage-users.php information disclosure
A vulnerability, which was classified as problematic, has been found in Typecho 1.2.1. Affected by this issue is some unknown functionality of the file /admin/manage-users.php. The manipulation of the argument page leads to information disclosure. The exploit…
-
Medium 4.5
QTS, QuTS hero
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vu…
-
Medium 6.5
QTS, QuTS hero
A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to inject malicious code via a network. We have already fixed the vulnerability in the following v…
-
Medium 4.9
QTS, QuTS hero
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vu…
-
High 8.0
Legacy VioStor NVR
An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability …
KEV Dec 21, 2023 -
Low 2.7
Typecho Page manage-pages.php backdoor
A vulnerability classified as problematic was found in Typecho 1.2.1. Affected by this vulnerability is an unknown functionality of the file /admin/manage-pages.php of the component Page Handler. The manipulation leads to backdoor. The attack can be launched …
-
Unscored —
In dhcp4_SetPDNAddress of dhcp4_Main.c, there is a possible out of bounds write due to a missing bounds check. This cou…
-
Unscored —
In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lea…
-
High 7.8
In gpu_pixel_handle_buffer_liveness_update_ioctl of private/google-modules/gpu/mali_kbase/platform/pixel/pixel_gpu_slc.…
-
Unscored —
there is a possible use after free due to a race condition. This could lead to local escalation of privilege with Syste…
-
Unscored —
In multiple locations, there is a possible null dereference due to a missing null check. This could lead to remote deni…
-
Unscored —
In Init of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could l…
-
Unscored —
In the Pixel Camera Driver, there is a possible use after free due to a logic error in the code. This could lead to loc…
-
Unscored —
In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lea…
-
Unscored —
In private_handle_t of mali_gralloc_buffer.h, there is a possible information leak due to a logic error in the code. Th…
-
Unscored —
In SignalStrengthAdapter::FillGsmSignalStrength() of protocolmiscadapter.cpp, there is a possible out of bounds read du…
-
Unscored —
In cd_ParseMsg of cd_codec.c, there is a possible out of bounds read due to a missing bounds check. This could lead to …
-
Unscored —
In gpu_pixel_handle_buffer_liveness_update_ioctl of private/google-modules/gpu/mali_kbase/mali_kbase_core_linux.c, ther…
-
Unscored —
In ProtocolNetSimFileInfoAdapter() of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing b…
-
Unscored —
there is a possible DCK won't be deleted after factory reset due to a logic error in the code. This could lead to local…
-
Unscored —
there is a possible permanent DoS or way for the modem to boot unverified firmware due to a logic error in the code. Th…
-
Unscored —
there is a possible way for the secure world to write to NS memory due to a logic error in the code. This could lead to…