CVE-2020-18032: Buffer Copy without Checking Size of Input

Buffer Overflow in Graphviz Graph Visualization Tools from commit ID f8b9e035 and earlier allows remote attackers to execute arbitrary code or cause a denial of service application crash by loading a crafted file into the "lib/common/shapes.c" component...

CVE-2021-23382

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service ReDoS via getAnnotationURL and loadAnnotation in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /\s sourceMappingURL=...

CVE-2021-23382: Inefficient Regular Expression Complexity

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service ReDoS via getAnnotationURL and loadAnnotation in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /\s sourceMappingURL=...

SUSE: Security Advisory (SUSE-SU-2019:2781-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-31162

In the standard library in Rust before 1.52.0, a double free can occur in the Vec::fromiter function if freeing the element panics...

CVE-2020-36323

CVE-2020-36323 – Rust stdlib string-joining optimization issue : The connected sources confirm a defect in Rust before 1.52.0 where a string-joining optimization could expose uninitialized bytes or cause a crash if the borrowed string changes after its length is checked. This is a security issue ...

WS-2021-0196

Rpc in versions v0.10.0-rc1 to v0.31.0 is allowing a malicious server to consume a significant amount of systemresources, which may be used as a denial of service vector. Related to rpc/lib/client/httpclient.go...

GHSA-333X-QR3V-G4XX Command injection in spritesheet-js

This affects all versions of package spritesheet-js. It depends on a vulnerable package platform-command. The injection point is located in line 32 in lib/generator.js, which is triggered by main entry of the package...

Command injection in spritesheet-js

This affects all versions of package spritesheet-js. It depends on a vulnerable package platform-command. The injection point is located in line 32 in lib/generator.js, which is triggered by main entry of the package...

@scullyio/init (1.0.0-beta.4) potentially affected by CVE-2020-28470 via @scullyio/ng-lib (1.0.0-beta.1)

@scullyio/ng-lib NPM version 1.0.0-beta.1 is affected by a known vulnerability. The following packages have a transitive dependency on @scullyio/ng-lib and may be impacted: - @scullyio/init 1.0.0-beta.4 Source cves: CVE-2020-28470 Source advisory: OSV:GHSA-R96P-V3CR-GFV8...

@scullyio/init (1.0.0-beta.4) potentially affected by CVE-2020-28470 via @scullyio/ng-lib (1.0.0-beta.1)

@scullyio/ng-lib NPM version 1.0.0-beta.1 is affected by a known vulnerability. The following packages have a transitive dependency on @scullyio/ng-lib and may be impacted: - @scullyio/init 1.0.0-beta.4 Source cves: CVE-2020-28470 Source advisory: GHSA-R96P-V3CR-GFV8...

GHSA-HH8V-JMH3-9437 Cross-site scripting in SocksJS-node

htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c aka callback parameter...

Cross-site scripting in SocksJS-node

htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c aka callback parameter...

CVE-2020-36317

The CVE-2020-36317 issue affects the Rust standard library prior to 1.49.0, where String::retain() can panic and allow creation of a non-UTF-8 Rust string. This may cause a memory-safety violation when other APIs assume UTF-8 on the same string. Several connected advisories confirm Rust 1.49.0 or...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), baluchon (0.0.1) +4 more potentially affected by CVE-2020-26759 via clickhouse-driver (>=0.1.1, <=0.1.4)

clickhouse-driver PYPI version =0.1.1, =0.5.1, =0.0.4, =2.2.0, =2.3.2 Source cves: CVE-2020-26759 Source advisory: OSV:GHSA-VGV5-CXVH-VFXH...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), baluchon (0.0.1) +4 more potentially affected by CVE-2020-26759 via clickhouse-driver (>=0.1.1, <=0.1.4)

clickhouse-driver PYPI version =0.1.1, =0.5.1, =0.0.4, =2.2.0, =2.3.2 Source cves: CVE-2020-26759 Source advisory: GHSA-VGV5-CXVH-VFXH...

printf vulnerable to Regular Expression Denial of Service (ReDoS)

The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service ReDoS via the regex string regex /%?:\w.+|1-9\d$?0 +-\|\d+?.?|\d+?hlL?%bscdeEfFgGioOuxX/g in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity...

Design/Logic Flaw

The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service ReDoS via the regex string /%?:\w.+|1-9\d$?0 +-\|\d+?.?|\d+?hlL?%bscdeEfFgGioOuxX/g in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity...

CVE-2021-23354

The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service ReDoS via the regex string /%?:\w.+|1-9\d$?0 +-|\d+?.?|\d+?hlL?%bscdeEfFgGioOuxX/g in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity...

CVE-2021-23354

The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service ReDoS via the regex string /%?:\w.+|1-9\d$?0 +-\|\d+?.?|\d+?hlL?%bscdeEfFgGioOuxX/g in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity...