CVE-2021-32723: Uncontrolled Resource Consumption

Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service ReDoS. When Prism is used to highlight untrusted user-given text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fix...

Mermaid Cross-Site Scripting Vulnerability

Mermaid is a Javascript-based drawing tool that uses a Markdown-like syntax to allow users to easily and quickly create diagrams from code.A cross-site scripting vulnerability exists in versions of Mermaid prior to 8.11.0 when using antiscript features. No details of the vulnerability are current...

The vulnerability of the application for 3D modeling and Paint 3D printing relates to the execution of operations beyond the buffer boundaries in memory, allowing an attacker to execute arbitrary code.

The vulnerability of the application for 3D modeling and Paint 3D printing is related to the execution of operations beyond the buffer in memory during the syntactic analysis of GLB and STL files. Exploiting this vulnerability allows a attacker to execute arbitrary code using a specially created...

Cross-site Scripting in wagtail

Impact When the % includeblock % template tag is used to output the value of a plain-text StreamField block CharBlock, TextBlock or a similar user-defined block derived from FieldBlock, and that block does not specify a template for rendering, the tag output is not properly escaped as HTML. This...

CVE-2021-32681

Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the % includeblock % template tag is used to output the value of a plain-text StreamField block...

The vulnerability of the uglify-js library in the Aurora application software allows a hacker to execute arbitrary code by exploiting syntax errors in input data.

The vulnerability of the uglify-js library in the Avrora software application is related to syntax checking errors in input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code using a specially crafted Java script...

in mcfriend99/bird

✍️ Description Heap-based 1-byte write violation. Certain programs can cause the parser/syntax-checker to write out of bounds. The below program writes a single byte out of bounds. 🕵️‍♂️ Proof of Concept Program: var a = 'outer' def test var a = 'inner' echo 'It works! $a' echo a echo test test def...

Oracle Linux 8 : raptor2 (ELSA-2021-1842)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-1842 advisory. - Resolves: rhbz1900904 CVE-2020-25713 raptor2: malformed input file can lead to a segfault - Resolves: rhbz1896534 CVE-2017-18926 raptor: heap-based...

Huawei EulerOS: Security Advisory for python-pygments (EulerOS-SA-2021-1887)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

raptor: heap-based buffer overflows due to an error in calculating the maximum nspace declarations for the XML writer

raptorxmlwriterstartelementcommon in raptorxmlwriter.c in Raptor RDF Syntax Library 2.0.15 miscalculates the maximum nspace declarations for the XML writer, leading to heap-based buffer overflows sometimes seen in raptorqnameformatasxml...

The vulnerability of the XML syntax analyzer in the Apache PDFBox Java library allows attackers to perform XXE attacks.

The vulnerability of the XML syntax analyzer in the Apache PDFBox Java library is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attacks using a specially created XFDF file...

CKEditor 4.0 vulnerability in the HTML Data Processor

A cross-site scripting XSS vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14.0 allows remote attackers to inject arbitrary web script through a crafted "protected" comment with the ckeprotected syntax...

[SECURITY] Fedora 32 Update: python-pygments-2.4.2-9.fc32

Pygments is a generic syntax highlighter for general use in all kinds of software such as forum systems, wikis or other applications that need to prettify source code. Highlights are: a wide range of common languages and markup formats is supported special attention is paid to details that increa...

[SECURITY] Fedora 33 Update: python-pygments-2.6.1-6.fc33

Pygments is a generic syntax highlighter for general use in all kinds of software such as forum systems, wikis or other applications that need to prettify source code. Highlights are: a wide range of common languages and markup formats is supported special attention is paid to details that increa...

Fedora: Security Advisory for python-pygments (FEDORA-2021-3f975f68c8)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for python-pygments (FEDORA-2021-166dfc62b2)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

The vulnerability affects implementations of syntactic analysis for XLS file formats in programs from Microsoft Office, Microsoft Office Web Apps Server, Microsoft Excel, Microsoft 365 Apps for Enterprise, and Microsoft Office Online Server. This allows attackers to execute arbitrary code.

The vulnerability of the XLS file syntax analysis implementation in Microsoft Office programs, such as Microsoft Office Web Apps Server, Microsoft Excel, Microsoft 365 Apps for Enterprise, and Microsoft Office Online Server, is related to the use of memory after it is released. Exploiting this...

The vulnerability of the module for syntactic analysis of PDF files in the ClamAV antivirus program allows a hacker to trigger a service failure.

The vulnerability of the PDF file syntax analysis module in the ClamAV antivirus program exists due to insufficient checks on input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the syntax analysis module in the email analysis part of the ClamAV antivirus program allows a hacker to trigger a service failure.

The vulnerability of the syntax analysis module in the ClamAV antivirus software package exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability relates to the implementation of syntactic analysis for CR3-files in the plugin for viewing RAW images. This allows an attacker to execute arbitrary code.

The vulnerability of the CR3-file syntax analysis implementation for viewing RAW images is related to errors in data type conversion. Exploiting this vulnerability could allow an attacker to execute arbitrary code using a specially created malicious web page or a specially created malicious file...