GQUIC dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file

LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file

RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.

Chromium: CVE-2023-4358 Use after free in DNS

Chromium: CVE-2023-4352 Type Confusion in V8

Chromium: CVE-2023-4355 Out of bounds memory access in V8

Chromium: CVE-2023-2723 Use after free in DevTools

Chromium: CVE-2023-2724 Type Confusion in V8

Chromium: CVE-2023-2726 Inappropriate implementation in WebApp Installs

Chromium: CVE-2023-2725 Use after free in Guest View

Chromium: CVE-2023-2722 Use after free in Autofill UI

Chromium: CVE-2023-5346 Type Confusion in V8

Chromium: CVE-2023-5472: Use after free in Profiles

A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pgdump and pgrestore. Versions of pgAdmin prior to 7.6 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server.

A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.

A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read local files from the server.

A race condition during dav1d decoding could have led to an out-of-bounds memory access, potentially leading to memory corruption and execution of malicious code.

Bottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file.

MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerability in the DNS packet decompression function allows an attacker to cause a Denial of Service by triggering an abnormal program termination. The vulnerability exists in the decompgetrddata function within the Decompress.c file. When handling a DNS packet with an Answer RR of qtype 16 (TXT record) and any qclass, if the rdlength is smaller than rdata, the result of the line Decompress.c:886 is a negative number len = rdlength - total;. This value is then passed to the decompappendbytes function without proper validation, causing the program to attempt to allocate a massive chunk of memory that is impossible to allocate. Consequently, the program exits with an error code of 64, causing a Denial of Service. One proposed fix for this vulnerability is to patch Decompress.c:887 by breaking if(len <= 0), which has been incorporated in version 3.5.0036 via commit bab062bde40b2ae8a91eecd522e84d8b993bab58.

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.

When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity. This could provide unintended access to the original meeting.

Chromium: CVE-2023-4572 Use after free in MediaStream

Chromium: CVE-2023-4430: Use after free in Vulkan

Chromium: CVE-2023-4431: Out of bounds memory access in Fonts

Chromium: CVE-2023-4429: Use after free in Loader

Chromium: CVE-2023-4361 Inappropriate implementation in Autofill

Chromium: CVE-2023-4364 Inappropriate implementation in Permission Prompts

Chromium: CVE-2023-4363 Inappropriate implementation in WebShare

Chromium: CVE-2023-4366 Use after free in Extensions