Rezultati pretraživanja za 'Od datuma: 27.12.2024.'
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-123616 | 7.5 | imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the data_size field. Attackers can supply a crafted 23-byte ICO file declaring a ~4GB data_size to trigger memory exhaust | 2026-11-08 02:16:57 | 2026-11-08 02:16:57 |
| CVE-2026-123615 | 7.5 | imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction (vips_foreign_load_ico_header in vips/icoload.c) when an ICO entry declares a tiny data size, causing unvalidated header fields t | 2026-11-08 02:16:57 | 2026-11-08 02:16:57 |
| CVE-2026-16710 | 5.8 | IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability. | 2026-11-08 02:16:57 | 2026-11-07 05:18:19 |
| CVE-2026-16679 | 4.3 | IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to view arbitrary files on the system due to a path traversal vulnerability. A specially crafted URL request could allow directories outside the intended location to be accessed. | 2026-11-08 02:16:57 | 2026-11-07 05:18:19 |
| CVE-2026-14252 | 6.2 | IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD stores potentially sensitive information in log files that could be read by a local | 2026-11-08 02:16:57 | 2026-11-04 21:18:12 |
| CVE-2026-123614 | 9.8 | imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocati | 2026-11-08 02:16:56 | 2026-11-08 02:16:56 |
| CVE-2026-123613 | 5.3 | Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or o | 2026-11-08 02:16:56 | 2026-11-08 02:16:56 |
| CVE-2026-123612 | 2.3 | rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before the handshake completes to the client-facing server when Encrypted Client Hello is rejected. Because start_traffic() queues plainte | 2026-11-08 02:16:56 | 2026-11-08 02:16:56 |
| CVE-2026-123611 | 3.7 | rustls before 0.23.46 contains a key exchange downgrade vulnerability that allows network attackers to poison the per-server-name key-exchange group record via an unauthenticated ServerHello. Attackers can answer one connection with a ServerHello sel | 2026-11-08 02:16:56 | 2026-11-08 02:16:56 |
| CVE-2026-123610 | 3.7 | rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate w | 2026-11-08 02:16:56 | 2026-11-08 02:16:56 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/12486
Zapisa po stranici: