#git

CVE-2023-5752: Mailman 3 [CVE-2023-5752] Mercurial configuration injectable in repo revision when installing via pip - Security-announce

When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.

1 year ago

CVE

Open in Source

#vulnerability #git

CVE-2023-46136: Merge 3.0.x (#2801) · pallets/werkzeug@f3c803b

Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. This vulnerability has been patched in version 3.0.1.

1 year ago

CVE

Open in Source

#vulnerability #web #dos #git

CVE-2023-46523: Digging/TP-LINK/TL-WR886N/3/1.md at main · XYIYM/Digging

TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function upgradeInfoRegister.

1 year ago

CVE

Open in Source

#vulnerability #git

CVE-2023-46521: Digging/TP-LINK/TL-WR886N/11/1.md at main · XYIYM/Digging

TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function RegisterRegister.