Vulnerabilities

Possible variant of CVE-2021-3434 in function le_ecred_reconf_req.

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.6 of Crowd Data Center and Server.<br /> <br /> This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.0, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction.<br /> <br /> Atlassian recommends that Crowd Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:<br /> Crowd Data Center and Server 3.4: Upgrade to a release greater than or equal to 5.1.6<br /> Crowd Data Center and Server 5.2: Upgrade to a release greater than or equal to 5.2.1<br /> <br /> See the release notes ([https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html]). You can download the latest version of Crowd Data Center and Server from the download center ([https://www.atlassian.com/software/crowd/download-archive]).<br /> <br /> This vulnerability was discovered by m1sn0w and reported via our Bug Bounty program

Texas Instruments TI-RTOS, when configured to use HeapMem heap(default),<br /> malloc returns a valid pointer to a small buffer on extremely large <br /> values, which can trigger an integer overflow vulnerability in <br /> &amp;#39;HeapMem_allocUnprotected&amp;#39; and result in code execution.

Texas Instruments devices running FREERTOS, malloc returns a valid <br /> pointer to a small buffer on extremely large values, which can trigger <br /> an integer overflow vulnerability in &amp;#39;malloc&amp;#39; for FreeRTOS, resulting in<br /> code execution.

This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 8.1.0, 8.2.0, 9.0.0, 9.1.0, 9.2.0, and 9.3.0 of Bamboo Data Center and Server.<br /> <br /> This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction.<br /> <br /> Atlassian recommends that Bamboo Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:<br /> Bamboo Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.7.<br /> JDK 1.8u121+ should be used in case Java 8 used to run Bamboo Data Center and Server. See Bamboo 9.2 Upgrade notes (https://confluence.atlassian.com/bambooreleases/bamboo-9-2-upgrade-notes-1207179212.html)<br /> <br /> Bamboo Data Center and Server 9.3: Upgrade to a release greater than or equal to 9.3.4<br /> <br /> See the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center and Server from the download center ([https://www.atlassian.com/software/bamboo/download-archives]).<br /> <br /> This vulnerability was discovered by a private user and reported via our Bug Bounty program

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

When an https: web page created a pop-up from a "javascript:" URL, that pop-up was incorrectly allowed to load blockable content such as iframes from insecure http: URLs This vulnerability affects Firefox

If an attacker needed a user to load an insecure http: page and knew that user had enabled HTTPS-only mode, the attacker could have tricked the user into clicking to grant an HTTPS-only exception if they could get the user to participate in a clicking game. This vulnerability affects Firefox

Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox

Memory safety bugs present in Firefox 119. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox

An attacker could have accessed internal pages or data by ex-filtrating a security key from ReaderMode via the `referrerpolicy` attribute. This vulnerability affects Firefox for iOS

An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information. This vulnerability affects Firefox for iOS