Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable FLUENTOJOPTIONMODE is explicitly set to object. Please note: The option FLUENTOJOPTIONMODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use FLUENTOJOPTIONMODE=object.
OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypass via a trailing pathname.
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.
Chromium: CVE-2023-1820 Heap buffer overflow in Browser History
Chromium: CVE-2023-2723 Use after free in DevTools
Chromium: CVE-2023-2724 Type Confusion in V8
Chromium: CVE-2023-2726 Inappropriate implementation in WebApp Installs
Chromium: CVE-2023-2722 Use after free in Autofill UI
Chromium: CVE-2023-2725 Use after free in Guest View
Chromium: CVE-2023-1812 Out of bounds memory access in DOM Bindings
Chromium: CVE-2023-1533 Use after free in WebProtect
Chromium: CVE-2023-1528 Use after free in Passwords
A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pgdump and pgrestore. Versions of pgAdmin prior to 7.6 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server.
Chromium: CVE-2023-5346 Type Confusion in V8
Chromium: CVE-2023-1815 Use after free in Networking APIs
Chromium: CVE-2023-2134 Out of bounds memory access in Service Worker API
Chromium: CVE-2023-2133 Out of bounds memory access in Service Worker API
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.
Chromium: CVE-2023-1818 Use after free in Vulkan
A code execution vulnerability exists in the DLDxf::handleLWPolylineData functionality of Ribbonsoft dxflib 3.17.0. A specially-crafted .dxf file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
libdwarf 0.4.1 has a double free in dwarfexecframeinstr in dwarfframe.c.
Chromium: CVE-2023-4352 Type Confusion in V8
Chromium: CVE-2023-4355 Out of bounds memory access in V8
Chromium: CVE-2023-4430: Use after free in Vulkan
Chromium: CVE-2023-4429: Use after free in Loader
Chromium: CVE-2023-1532 Out of bounds read in GPU Video
Chromium: CVE-2023-4572 Use after free in MediaStream
Chromium: CVE-2023-4431: Out of bounds memory access in Fonts
A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system.
Bottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file.