Archive
5 March 2024
Vulnerabilities first published on this day (UTC), newest first.
27 results · Clear filters · Feed
-
High 7.5
Infinite loop in JSON unmarshaling in google.golang.org/protobuf
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown opti…
-
High 7.5
Comments in display names are incorrectly handled in net/mail
The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.
-
High 7.6
Improper privilege management in Just-in-time (JIT) elevation module in Devolutions Server 2023.3.14.0 and earlier allo…
-
High 7.2
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of…
-
High 7.2
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of…
-
High 7.2
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of…
-
High 7.2
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of…
-
High 7.8
A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, …
KEV Mar 6, 2024 -
High 7.8CVE-2024-23225 Exploited
A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, …
KEV Mar 6, 2024 -
High 7.5
Artica Proxy Unauthenticated LFI Protection Bypass Vulnerability
The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. This issue was demonstrated on version 4.50 of the The Artica-Proxy adminis…
-
High 7.0
IBM Cloud Pak for Automation CSV injection
IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, cause…
-
High 7.1
Information disclosure vulnerability
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI USB controller. A malicious actor with administrative access to a virtual machine may be able to exploit this issue to leak memory from the vmx process.
-
High 7.9
Out-of-bounds write vulnerability
VMware ESXi contains an out-of-bounds write vulnerability. A malicious actor with privileges within the VMX process may trigger an out-of-bounds write leading to an escape of the sandbox.
-
High 7.1
Use After Free in SixLabors.ImageSharp
ImageSharp is a managed, cross-platform, 2D graphics library. A heap-use-after-free flaw was found in ImageSharp's InitializeImage() function of PngDecoderCore.cs file. This vulnerability is triggered when an attacker passes a specially crafted PNG image file…
-
High 7.5
A CWE-122 “Heap-based Buffer Overflow” vulnerability in the “logger_generic” function of the “Ax_rtu” binary allows a r…
-
High 8.1
crypto: qcom-rng - ensure buffer for generate is completely filled
In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - ensure buffer for generate is completely filled The generate function in struct rng_alg expects that the destination buffer is completely filled if the function returns 0. …
-
High 7.5
A CWE-1269 “Product Released in Non-Release Configuration” vulnerability in the Django web framework used by the web ap…
-
High 8.1
A CWE-798 “Use of Hard-coded Credentials” vulnerability in the MariaDB database of the web application allows a remote …
-
High 8.8
Vimeography: Vimeo Video Gallery WordPress Plugin <= 2.3.2 - Authenticated (Contributor+) PHP Object Injection
The Vimeography: Vimeo Video Gallery WordPress Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.2 via deserialization of untrusted input via the vimeography_duplicate_gallery_serialized in the duplica…
-
High 8.8
Auto Refresh Single Page <= 1.1 - Authenticated (Contributor+) PHP Object Injection
The Auto Refresh Single Page plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1 via deserialization of untrusted input from the arsp_options post meta option. This makes it possible for authenticated attackers…
-
High 8.8CVE-2023-43318 Public exploit
TP-Link JetStream Smart Switch TL-SG2210P 5.0 Build 20211201 allows attackers to escalate privileges via modification o…
-
High 7.5
An issue in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive inform…
-
High 7.2
A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.…
-
High 8.4
eza Potential Heap Overflow Vulnerability for AArch64
Buffer Overflow vulnerability in eza before version 0.18.2, allows local attackers to execute arbitrary code via the .git/HEAD, .git/refs, and .git/objects components.
-
High 7.5
libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. This flaw allows an attacker to cause a d…
-
High 8.4
In Foxit PDF Reader before 2024.1 and PDF Editor before 2024.1, code execution via JavaScript could occur because of an…
-
High 7.2
TYPO3 Install Tool vulnerable to Code Execution
TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the privileges of the web server) via a command injection vulnerability in form fields of the Install Tool. The fixed versions…