MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pymini…

▾ Midnightzlib · zlibEPSS 3.2%via NVD

CVE-2023-23930High· 7.2

2y ago

Pickle serialization vulnerable to Deserialization of Untrusted Data

▾ Twilightvantage6 · vantage6EPSS 0.89%via OSV

Tagged “osv”

Malicious code in littest (crates.io)

Kubernetes privilege escalation vulnerability

Synapse vulnerable to leak of remote user device information

Possible Infinite Loop when PdfWriter(clone_from) is used with a PDF

quic-go vulnerable to pointer dereference that can lead to panic

Kube-proxy may unintentionally forward traffic

Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerability

Home Assistant vulnerable to account takeover via auth_callback login

Command Injection in pip when used with Mercurial

Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

Ingress-nginx path sanitization can be bypassed

Ingress nginx annotation injection causes arbitrary command execution

dtale vulnerable to Remote Code Execution through the Custom Filter Input

Jumpserver Koko vulnerable to remote code execution on the host system via MongoDB shell

Nautobot vulnerable to exposure of hashed user passwords via REST API

Fides Information Disclosure Vulnerability in Config API Endpoint

Fides Server-Side Request Forgery Vulnerability in Custom Integration Upload

Fides JavaScript Injection Vulnerability in Privacy Center URL

Langchain Server-Side Request Forgery vulnerability

mycli has Inadequate Encryption Strength

PDM Trojan Lockfile

NATS.io: Adding accounts for just the system account adds auth bypass

TorBot vulnerable to Inefficient Regular Expression Complexity in validate_link

Arduino Create Agent path traversal - local privilege escalation vulnerability

Arduino Create Agent Insufficient Verification of Data Authenticity vulnerability

Cross-site Scripting via missing Binding syntax validation

urllib3's request body not stripped after redirect from 303 status changes request method to GET

vantage6 does not properly delete linked resources when deleting a collaboration

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field

Pickle serialization vulnerable to Deserialization of Untrusted Data