CVSS: 10.0EPSS: 0%CPEs: 9EXPL: 0CVE-2024-36039 – python-pymysql: SQL injection if used with untrusted JSON input
https://notcve.org/view.php?id=CVE-2024-36039
21 May 2024 — PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict. PyMySQL hasta 1.1.0 permite la inyección de SQL si se usa con entradas JSON que no son de confianza porque escape_dict no escapa las claves. A flaw was found in PyMySQL. When processing untrusted JSON input, keys are not escaped by the escape_dict function due to insufficient input sanitization, allowing an attacker to inject malicious SQL queries. It was discovered that PyMySQL incorrec... • https://github.com/PyMySQL/PyMySQL/releases/tag/v1.1.1 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-36048
https://notcve.org/view.php?id=CVE-2024-36048
18 May 2024 — QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values. QAbstractOAuth en Qt Network Authorization en Qt antes de 5.15.17, 6.x antes de 6.2.13, 6.3.x hasta 6.5.x antes de 6.5.6 y 6.6.x hasta 6.7.x antes de 6.7.1 usa solo el tiempo de inicialización PRNG, lo que puede dar como resultado valores adivinables. • https://codereview.qt-project.org/c/qt/qtnetworkauth/+/560317 • CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) •
CVSS: 7.8EPSS: 0%CPEs: 26EXPL: 0CVE-2024-4453 – GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-4453
17 May 2024 — GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of EXIF metadata. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before... • https://gitlab.freedesktop.org/tpm/gstreamer/-/commit/e68eccff103ab0e91e6d77a892f57131b33902f5 • CWE-190: Integer Overflow or Wraparound •
CVSS: 3.3EPSS: 0%CPEs: 15EXPL: 0CVE-2023-47169
https://notcve.org/view.php?id=CVE-2023-47169
16 May 2024 — Improper buffer restrictions in Intel(R) Media SDK software all versions may allow an authenticated user to potentially enable denial of service via local access. Las restricciones incorrectas del búfer en todas las versiones del software Intel(R) Media SDK pueden permitir que un usuario autenticado potencialmente habilite la denegación de servicio a través del acceso local. • https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00935.html • CWE-92: DEPRECATED: Improper Sanitization of Custom Special Characters CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 3.9EPSS: 0%CPEs: 16EXPL: 0CVE-2023-47282
https://notcve.org/view.php?id=CVE-2023-47282
16 May 2024 — Out-of-bounds write in Intel(R) Media SDK all versions and some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable escalation of privilege via local access. La escritura fuera de los límites en Intel(R) Media SDK en todas las versiones y en algunos software Intel(R) oneVPL anteriores a la versión 23.3.5 puede permitir que un usuario autenticado habilite potencialmente la escalada de privilegios a través del acceso local. • https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00935.html • CWE-787: Out-of-bounds Write •
CVSS: 3.9EPSS: 0%CPEs: 16EXPL: 0CVE-2023-22656
https://notcve.org/view.php?id=CVE-2023-22656
16 May 2024 — Out-of-bounds read in Intel(R) Media SDK and some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable escalation of privilege via local access. La lectura fuera de los límites en Intel(R) Media SDK y algún software Intel(R) oneVPL anterior a la versión 23.3.5 puede permitir que un usuario autenticado habilite potencialmente la escalada de privilegios a través del acceso local. • https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00935.html • CWE-125: Out-of-bounds Read •
CVSS: 4.8EPSS: 0%CPEs: 14EXPL: 0CVE-2023-45221
https://notcve.org/view.php?id=CVE-2023-45221
16 May 2024 — Improper buffer restrictions in Intel(R) Media SDK all versions may allow an authenticated user to potentially enable escalation of privilege via local access. Las restricciones inadecuadas del búfer en Intel(R) Media SDK en todas las versiones pueden permitir que un usuario autenticado potencialmente habilite la escalada de privilegios a través del acceso local. • https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00935.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.9EPSS: 0%CPEs: 15EXPL: 0CVE-2023-48368
https://notcve.org/view.php?id=CVE-2023-48368
16 May 2024 — Improper input validation in Intel(R) Media SDK software all versions may allow an authenticated user to potentially enable denial of service via local access. La validación de entrada incorrecta en todas las versiones del software Intel(R) Media SDK puede permitir que un usuario autenticado potencialmente habilite la denegación de servicio a través del acceso local. • https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00935.html • CWE-20: Improper Input Validation CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.0EPSS: 0%CPEs: 13EXPL: 0CVE-2023-47855 – Ubuntu Security Notice USN-6797-1
https://notcve.org/view.php?id=CVE-2023-47855
16 May 2024 — Improper input validation in some Intel(R) TDX module software before version 1.5.05.46.698 may allow a privileged user to potentially enable escalation of privilege via local access. La validación de entrada incorrecta en algún software de módulo Intel(R) TDX anterior a la versión 1.5.05.46.698 puede permitir que un usuario privilegiado habilite potencialmente la escalada de privilegios a través del acceso local. It was discovered that some 3rd and 4th Generation Intel® Xeon® Processors did not properly ... • https://security.netapp.com/advisory/ntap-20240621-0003 • CWE-20: Improper Input Validation •
CVSS: 7.9EPSS: 0%CPEs: 14EXPL: 0CVE-2023-45745
https://notcve.org/view.php?id=CVE-2023-45745
16 May 2024 — Improper input validation in some Intel(R) TDX module software before version 1.5.05.46.698 may allow a privileged user to potentially enable escalation of privilege via local access. La validación de entrada incorrecta en algún software de módulo Intel(R) TDX anterior a la versión 1.5.05.46.698 puede permitir que un usuario privilegiado habilite potencialmente la escalada de privilegios a través del acceso local. • https://security.netapp.com/advisory/ntap-20240621-0003 • CWE-20: Improper Input Validation •