CVE-2021-37634

Leafkit is a templating language with Swift-inspired syntax. Versions prior to 1.3.0 are susceptible to Cross-site Scripting XSS attacks. This affects anyone passing unsanitised data to Leaf's variable tags. Before this fix, Leaf would not escape any strings passed to tags as variables. If an...

GitLab: ReDoS in syntax highlighting due to Rouge

Summary Gitlab is using the ruby gem "rouge" which has a ReDoS vulnerability. In rouge, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have cubic worst-case complexity and are vulnerable to Regular Expression Denial of Service...

Vulnerability of software for modeling, design, and drawing in AutoCAD, related to data writing beyond the buffer, allowing a perpetrator to execute arbitrary code

The vulnerability of software for modeling, designing, and drawing in AutoCAD relates to the writing of data beyond the buffer during syntax analysis of DWG files. Exploiting this vulnerability can allow an attacker to execute arbitrary code using a specially created DWG file...

U.S. Dept Of Defense: SQL injection located in `███` in POST param `████████`

Hey DoD security team! I was able to exploit an SQL injection 1 in one of your domains. Description An SQL injection 1 was discovered in domain https://████████/██████ in the parameter ██████████. The SQL injection was located in a WHERE statment fallowed by a INT value. The vulnerable parameter...

The vulnerability of the implementation of syntactic analysis for PDF format files in the Autodesk Design Review software allows a perpetrator to execute arbitrary code.

The vulnerability of the PDF syntax analysis implementation in the Autodesk Design Review software for applying electronic annotations is related to a memory reclamation error. Exploiting this vulnerability could allow an attacker to execute arbitrary code remotely...

The vulnerability of the implementation of syntactic analysis for TGA format files in the Autodesk Design Review software allows a perpetrator to execute arbitrary code.

The vulnerability of the TGA file syntax analysis implementation in the Autodesk Design Review software relates to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the implementation of syntactic analysis for DWF format files in the Autodesk Design Review software allows a perpetrator to execute arbitrary code.

The vulnerability of the syntax analysis implementation for DWF format files in the Autodesk Design Review software lies in the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to execute arbitrary code remotely...

The vulnerability of the implementation of syntactic analysis for PDF format files in the Autodesk Design Review software allows a perpetrator to execute arbitrary code.

The vulnerability of the PDF syntax analysis implementation of the Autodesk Design Review software relates to data type conversion errors. Exploiting this vulnerability could allow an attacker to execute arbitrary code remotely...

The vulnerability of the implementation of syntactic analysis for PDF format files in the Autodesk Design Review software allows a perpetrator to execute arbitrary code.

The vulnerability of the PDF syntax analysis implementation in the Autodesk Design Review software relates to the writing of data beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the dynamically linked library ugeom2d.dll, a set of tools for design and simulation in Siemens Solid Edge, allows a hacker to execute arbitrary code.

The vulnerability of the dynamically linked library ugeom2d.dll, which is part of Siemens Solid Edge’s design and modeling tools, relates to the writing beyond buffer boundaries in memory during DFT file syntax analysis. Exploiting this vulnerability could allow an attacker to execute arbitrary...

The vulnerability of the implementation of syntax analysis for TIF format files in the Autodesk Design Review software allows a perpetrator to execute arbitrary code.

The vulnerability of the TIF file syntax analysis implementation in the Autodesk Design Review software relates to the writing of data beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code remotely...

The vulnerability of the dynamically linked library jutil.dll, a set of tools for design and simulation in Siemens Solid Edge, allows a perpetrator to execute arbitrary code.

The vulnerability of the dynamically linked library jutil.dll, which is part of the Siemens Solid Edge design and simulation tools, relates to writing beyond buffer boundaries in memory during DFT file syntax analysis. Exploiting this vulnerability could allow an attacker to execute arbitrary cod...

The vulnerability of the mysql-wsrep component of the MariaDB database lies in errors during the processing of input data during syntax analysis. This allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the mysql-wsrep component of the MariaDB database is related to errors in processing input data during syntax analysis of the code. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

Huawei EulerOS: Security Advisory for python-pygments (EulerOS-SA-2021-2054)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-32723

Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service ReDoS. When Prism is used to highlight untrusted user-given text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fix...

CVE-2021-32723

Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service ReDoS. When Prism is used to highlight untrusted user-given text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fix...

Design/Logic Flaw

Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service ReDoS. When Prism is used to highlight untrusted user-given text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fix...

CVE-2021-32723

Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service ReDoS. When Prism is used to highlight untrusted user-given text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fix...

CVE-2021-32723

PrismJS Prism before v1.24.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when highlighting untrusted text. Specifically, ASCIIDoc and ERB are susceptible to crafted input that can cause excessive highlighting time; other languages are not affected. The vulnerability has been fix...

@21epub/resource-lib (>=1.0.0, <=1.0.3), @2fn/helpers (>=1.0.0, <=1.0.1) +3161 more potentially affected by CVE-2021-32723 via prismjs (>=1.2.0, <=1.23.0)

prismjs NPM version =1.2.0, =1.0.0, =1.0.0, =1.0.23, =1.0.1, =1.2.0, =1.0.0, =1.1.4, =1.16.0, =1.1.2, =0.5.19-20200320212412, =1.0.0-beta.10, =1.0.0-beta.14 - @adebawo-damilare/esm-reports-app 5.2.0 - @admin-bro/design-system 1.4.0 - @afzalh/aug07 1.1.2 and more Source cves: CVE-2021-32723 Source...