Open Source Vulnerabilities
CESNET ipfixcol2 2.7.1 before 2.9.0 Heap Buffer Overflow via TCP LZ4 Decoder
CESNET ipfixcol2 2.7.1 before 2.9.0 Heap Buffer Overflow via TCP LZ4 Decoder
reSIProcate reTurn client through 1.14.0 Heap Buffer Overflow via TurnTcpSocket
reSIProcate reTurn client through 1.14.0 Heap Buffer Overflow via TurnTcpSocket
netrek-client-cow through 3.3.3 Stack Buffer Overflow via handleSMessage
netrek-client-cow through 3.3.3 Stack Buffer Overflow via handleSMessage
Netrek-client-cow through 3.3.3 Out-of-Bounds Read via SP_S_MESSAGE Packets
Netrek-client-cow through 3.3.3 Out-of-Bounds Read via SP_S_MESSAGE Packets
Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable
Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable
DataLinkDC Dinky flink_web Proxy Endpoint FlinkWebURITemplateProxyServlet.java FlinkWebURITemplateProxyServlet.getNewTargetUri server-side request forgery
DataLinkDC Dinky flink_web Proxy Endpoint FlinkWebURITemplateProxyServlet.java FlinkWebURITemplateProxyServlet.getNewTargetUri server-side request forgery
Guest access to Firecracker process memory after a failed memory discard
Guest access to Firecracker process memory after a failed memory discard
Solidtime: Path Traversal in Toggl ZIP Data Importer - arbitrary directory creation + filesystem existence oracle
Solidtime: Path Traversal in Toggl ZIP Data Importer - arbitrary directory creation + filesystem existence oracle
Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser
Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser
ruby-omniauth, ruby-omniauth, ruby-omniauth
Zulip: Saving a draft DM to a user bypasses can_access_all_users_group permission
Zulip: Saving a draft DM to a user bypasses can_access_all_users_group permission
Zulip: Custom profile fields can be read by logged-out visitors in organization with web-public channels
Zulip: Custom profile fields can be read by logged-out visitors in organization with web-public channels
Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests
Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests
OmniAuth: Host Header Injection Vulnerability
ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundary
ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundary
ESP-IDF: Stack-based memory corruption in lwIP DNS/SNTP handling for multi-IP DNS responses
ESP-IDF: Stack-based memory corruption in lwIP DNS/SNTP handling for multi-IP DNS responses
