Arbitrary file deletion

A PHP Local File inclusion vulnerability in the Redbasic theme for Hubzilla before version 7.2 allows remote attackers to include arbitrary php files via the schema parameter...

CVE-2022-27256

A PHP Local File inclusion vulnerability in the Redbasic theme for Hubzilla before version 7.2 allows remote attackers to include arbitrary php files via the schema parameter...

CVE-2022-27256: URL Redirection to Untrusted Site

A PHP Local File inclusion vulnerability in the Redbasic theme for Hubzilla before version 7.2 allows remote attackers to include arbitrary php files via the schema parameter...

PT-2022-18333

Name of the Vulnerable Software and Affected Versions Hubzilla versions prior to 7.2 Description The issue allows remote attackers to include arbitrary php files via the schema parameter or redirect a logged in user to an arbitrary URL via the rpath parameter. Recommendations For versions prior t...

CVE-2022-25757

In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a duplicate key, the attacker can bypass the bodyschema validation in the request-validation plugin. For example,...

MySQL Server Information Schema DoS

Vulnerability of the MySQL Server component: The information schema of the MySQL Server database management system is related to resource release errors. Exploiting this vulnerability can allow a malicious actor to cause service interruptions using the MySQL network protocol...

MySQL Server Information Schema DoS

Vulnerability of the MySQL Server component: The information schema of the MySQL Server database management system is related to resource release errors. Exploiting this vulnerability can allow a malicious actor to cause service interruptions using the MySQL network protocol...

PT-2022-17492 · Apache · Apache Apisix

Name of the Vulnerable Software and Affected Versions: Apache APISIX versions prior to 2.13.0 Description: The issue allows an attacker to bypass body schema validation in the request-validation plugin by passing a JSON with a duplicate key. This can be achieved by sending a JSON payload such as...

Apache Apisix input validation vulnerability

Apache Apisix is a cloud-native microservices API gateway service from the Apache Foundation. The software is based on OpenResty and etcd, with dynamic routing and plugin hot-loading for API management in microservices systems. An attacker could use this vulnerability to bypass the bodyschema...

[SECURITY] Fedora 36 Update: python-fastapi-0.75.0-3.fc36

FastAPI is a modern, fast high-performance, web framework for building APIs with Python 3.6+ based on standard Python type hints. The key features are: =EF=BF=BD=EF=BF=BD=EF=BF=BD Fast: Very high performance, on par with NodeJS and Go thanks to Starlette and Pydantic. One of the fastest Python...

libxml2:schema: Segv on unknown address in ld-linux-x86-64.so.2

Detailed Report: https://oss-fuzz.com/testcase?key=5557530963607552 Project: libxml2 Fuzzing Engine: libFuzzer Fuzz Target: schema Job Type: libfuzzermsanlibxml2 Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: ld-linux-x86-64.so.2 ld-linux-x86-64.so.2...

libxml2:schema: Nested bug in the same thread, aborting. with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5289624191238144 Project: libxml2 Fuzzing Engine: libFuzzer Fuzz Target: schema Job Type: libfuzzermsanlibxml2 Platform Id: linux Crash Type: Nested bug in the same thread, aborting. Crash Address: Crash State: NULL Sanitizer: memory MSAN Crash...

libxml2:schema: Use-of-uninitialized-value in xmlStrdup

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=4975763265290240 Project: libxml2 Fuzzing Engine: libFuzzer Fuzz Target: schema Job Type: libfuzzermsanlibxml2 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash Stat...

libxml2:schema: Use-of-uninitialized-value in xmlDictLookup

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=6420529093935104 Project: libxml2 Fuzzing Engine: libFuzzer Fuzz Target: schema Job Type: libfuzzermsanlibxml2 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash Stat...

AlmaLinux 8 : nodejs:14 (ALSA-2022:0350)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:0350 advisory. nodejs-json-schema: Prototype pollution vulnerability CVE-2021-3918 nodejs-ini: Prototype pollution via malicious INI file CVE-2020-7788 nodejs-glob-paren...

AlmaLinux 8 : nodejs:16 (ALSA-2021:5171)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:5171 advisory. nodejs-json-schema: Prototype pollution vulnerability CVE-2021-3918 nodejs-ini: Prototype pollution via malicious INI file CVE-2020-7788 nodejs-glob-paren...

libxml2:schema: Use-of-uninitialized-value in xmlDictGrow

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=6667834971783168 Project: libxml2 Fuzzing Engine: libFuzzer Fuzz Target: schema Job Type: libfuzzermsanlibxml2 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash Stat...

azureml-webservice-schema (>=0.1.57, <=1.0.33), mmtfpyspark (0.2.7) +1 more potentially affected by CVE-2021-38296 via pyspark (2.3.1)

pyspark PYPI version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - azureml-webservice-schema =0.1.57, =2.0.3, =2.1.1 Source cves: CVE-2021-38296 Source advisory: OSV:GHSA-9RR6-JPG7-9JG6...

libxml2:schema: Invalid-free in xmlFreeNodeList

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=6139378353700864 Project: libxml2 Fuzzing Engine: libFuzzer Fuzz Target: schema Job Type: libfuzzerasani386libxml2 Platform Id: linux Crash Type: Invalid-free Crash Address: 0xf30037c8 Crash...

azureml-webservice-schema (>=0.1.57, <=1.0.33), mmtfpyspark (0.2.7) +1 more potentially affected by CVE-2021-38296 via pyspark (2.3.1)

pyspark PYPI version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - azureml-webservice-schema =0.1.57, =2.0.3, =2.1.1 Source cves: CVE-2021-38296 Source advisory: OSV:PYSEC-2022-186...