An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICMP Echo Request that carries an IPv4 Record Route or Timestamp option, icmpv4updaterecordroute() and icmpv4updatetimestamp() in subsys/net/ip/icmpv4.c compute the length of the already recorded data as ptr - ptroffset in uint8t arithmetic. The attacker-controlled Pointer field is checked against the option length but not against the RFC 791 minimum (4 for Record Route, 5 for Timestamp), so a smaller value wraps the length to up to 252 bytes. netpktwrite() then reads past the 40-byte optdata stack buffer and up to 213 bytes of stack memory, which can include stack and heap pointers, are returned in the ICMP Echo Reply. A single packet triggers the leak and the device does not crash, so it can be repeated. Devices built with CONFIGNETIPV4HDROPTIONS, which CONFIGNETIPV4IGMP selects, are affected.

A vulnerability was determined in ToolJet up to 3.20.256-lts/3.21.93-beta. The impacted element is the function activateUserWithPassword of the file server/src/modules/onboarding/util.service.ts of the component Onboarding Signup Endpoint. Executing a manipulation of the argument email can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.21.94-beta is sufficient to resolve this issue. This patch is called af8f17a745621ae418f1743440f63d315e8b8643. The affected component should be upgraded. The vendor was contacted early about this disclosure.

A vulnerability has been found in rmalright TR-VISION HOME 2.0.5. Impacted is the function sub11504 in the library WFanManager.sys of the component IOCTL Handler. Such manipulation leads to incorrect default permissions. The attack must be carried out locally. The vendor was contacted early about this disclosure but did not respond in any way.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Code Injection.This issue affects Quiz And Survey Master: from n/a through 11.3.0.

Missing Authorization vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through 11.3.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through 3.9.1.

Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in dumpqr.

A Regexp's pattern is written into a qr literal without escaping "$" or "@", so "@{[ ... ]}" and "${\ ... }" in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early.

An attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code.

Fraunhofer HHI VVdeC before 3.2.1 contains a heap out-of-bounds read vulnerability in SEIReader::xParseSEIScalableNesting that allows attackers to read past heap allocations by casting the SEI wrapper object instead of its payload. Attackers can supply a crafted VVC bitstream with a scalable nesting SEI containing a nested buffering period SEI to crash the decoder or copy adjacent heap memory.

Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability in DecLibRecon::createSubPicRefBufs because decompressPicture clears msubPicExtTasks without waiting for pending tasks. Attackers can supply a crafted multi-subpicture VVC bitstream to decoders using two or more threads, causing heap memory corruption or a decoder crash.

A flaw was found in the xfsadmin utility in xfsprogs. The tool does n ...

TuxCare rebuilt @opentelemetry/instrumentation-mysql2 to address 1 CVE. Fixed in 0.40.0-tuxcare.1.

TuxCare rebuilt 3 org.apache.solr packages to address 5 CVEs. Fixed in 7.7.2-tuxcare.1.

TuxCare rebuilt @opentelemetry/instrumentation-mongoose to address 1 CVE. Fixed in 0.40.0-tuxcare.3.

TuxCare rebuilt @opentelemetry/instrumentation-cassandra-driver to address 1 CVE. Fixed in 0.40.0-tuxcare.4.

TuxCare rebuilt @opentelemetry/instrumentation-cassandra-driver to address 1 CVE. Fixed in 0.44.0-tuxcare.1.

TuxCare rebuilt @opentelemetry/instrumentation-pg to address 1 CVE. Fixed in 0.43.0-tuxcare.1.

TuxCare rebuilt @opentelemetry/instrumentation-mysql to address 1 CVE. Fixed in 0.34.5-tuxcare.2.

TuxCare rebuilt @opentelemetry/instrumentation-mysql2 to address 1 CVE. Fixed in 0.34.5-tuxcare.1.

TuxCare rebuilt com.nimbusds:nimbus-jose-jwt to address 3 CVEs. Fixed in 3.10-tuxcare.3.

TuxCare rebuilt @opentelemetry/instrumentation-mongoose to address 1 CVE. Fixed in 0.33.4-tuxcare.1.

TuxCare rebuilt @opentelemetry/instrumentation-mysql2 to address 1 CVE. Fixed in 0.44.0-tuxcare.2.

TuxCare rebuilt @opentelemetry/instrumentation-mysql to address 1 CVE. Fixed in 0.40.0-tuxcare.2.

TuxCare rebuilt @opentelemetry/instrumentation-tedious to address 1 CVE. Fixed in 0.27.0-tuxcare.1.

Security vulnerability affects the sonarqube package. Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).

Security vulnerability affects the sonarqube package. This issue is resolved in later releases. See references for vulnerability details.

Security vulnerability affects the zookeeper-operator package. A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped.

Security vulnerability affects the zookeeper-operator package. On Windows, when the target of Root.

Security vulnerability affects the strimzi-kafka-operator package. A flaw was found in Netty's WebSocketServerExtensionHandler.

Security vulnerability affects the strimzi-kafka-operator package. zstd-jni before 1.

Security vulnerability affects the litellm-database package. Tornado before 6.