CVE-2021-3403: Use After Free

In ytnef 1.9.3, the TNEFSubjectHandler function in lib/ytnef.c allows remote attackers to cause a denial-of-service and potentially code execution due to a double free which can be triggered via a crafted file...

openSUSE Security Update : nghttp2 (openSUSE-2021-341)

This update for nghttp2 fixes the following issues : nghttp2 was update to version 1.40.0 bsc1166481 - lib: Add nghttp2checkauthority as public API - lib: Fix the bug that stream is closed with wrong error code - lib: Faster huffman encoding and decoding - build: Avoid filename collision of stati...

Security update for nghttp2 (moderate)

openSUSE Security Update: Security update for nghttp2 Announcement ID: openSUSE-SU-2021:0341-1 Rating: moderate References: 1159003 1166481 Cross-References: CVE-2019-18802 CVSS scores: CVE-2019-18802 NVD : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-18802 SUSE: 7.5...

CVE-2021-27228: Use of Hard-coded Credentials

An issue was discovered in Shinobi through ocean version 1. lib/auth.js has Incorrect Access Control. Valid API Keys are held in an internal JS Object. Therefore an attacker can use JS Proto Method names such as constructor or hasOwnProperty to convince the System that the supplied API Key exists...

CVE-2020-24617

Mailtrain through 1.24.1 allows SQL Injection in statsClickedSubscribersByColumn in lib/models/campaigns.js via /campaigns/clicked/ajax because variable column names are not properly escaped...

CVE-2020-24617: Improper Neutralization of Special Elements used in an SQL Command

Mailtrain through 1.24.1 allows SQL Injection in statsClickedSubscribersByColumn in lib/models/campaigns.js via /campaigns/clicked/ajax because variable column names are not properly escaped...

The vulnerability of the _proc_pax function (Lib/tarfile.py) in the Python programming language allows a attacker to cause a service failure.

The vulnerability of the procpax function in the Lib/tarfile.py module of the Python interpreter is related to insufficient input validation. Exploiting this vulnerability could allow an attacker to cause service failures remotely...

The vulnerability in the implementations of the IPv4Interface and IPv6Interface classes in the Lib/ipaddress.py module of the Python programming language allows a attacker to cause a service failure.

The vulnerability of the IPv4Interface and IPv6Interface classes in the Lib/ipaddress.py module of the Python programming language involves an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

CVE-2020-7785

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

Code injection

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

CVE-2020-7785 Command Injection

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

CVE-2020-7782: Improper Neutralization of Special Elements used in an OS Command

This affects all versions of package spritesheet-js. It depends on a vulnerable package platform-command. The injection point is located in line 32 in lib/generator.js, which is triggered by main entry of the package...

spritesheet.js Injection Vulnerability

spritesheet.js is a command line Spritesheet aka Texture Atlas generator written in node.js by the Polish individual developer Krzysztof-o spritesheet.js. Provides Spritesheet aka Texture Atlas command line generation. An injection vulnerability exists in spritsheet. The vulnerability stems from...

Neekey node-ps injection vulnerability

Neekey node-ps is a lookup tool from the US-based individual developer Neekey. It is provided to find running processes. An injection vulnerability exists in Neekey node-ps, which stems from a lack of proper validation of user input data in lib/index.js, which is not filtered or does not correctl...

CVE-2020-7785: Improper Neutralization of Special Elements used in an OS Command

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

openSUSE Security Update : the Linux Kernel (openSUSE-2021-241)

The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel bnc1181349. - CVE-2021-3348:...

CVE-2021-21304: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Dynamoose is an open-source modeling tool for Amazon's DynamoDB. In Dynamoose from version 2.0.0 and before version 2.7.0 there was a prototype pollution vulnerability in the internal utility method "lib/utils/object/set.ts". This method is used throughout the codebase for various operations...

CVE-2021-21284

In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesystem they can...

UBUNTU-CVE-2021-21284

In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesystem they can...

CVE-2021-21284: Improper Limitation of a Pathname to a Restricted Directory

In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesystem they can...