8986 matches found
python: Web cache poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a semicolon in query parameters
The package python/cpython is vulnerable to Web Cache Poisoning via urllib.parse.parseqsl and urllib.parse.parseqs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon ;, they can cause a difference in the interpretation of the request...
python: Web cache poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a semicolon in query parameters
The package python/cpython is vulnerable to Web Cache Poisoning via urllib.parse.parseqsl and urllib.parse.parseqs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon ;, they can cause a difference in the interpretation of the request...
graphviz: off-by-one in parse_reclbl() in lib/common/shapes.c
A flaw was found in graphviz. A wrong assumption in recordinit function leads to an off-by-one write in parsereclbl function, allowing an attacker who can provide graph input to potentially execute code when the label of a node is invalid and shorter than two characters. The highest threat from...
zlog 1.2.15 - Buffer Overflow Exploit
Exploit Title: zlog 1.2.15 - Buffer Overflow Exploit Author: LIWEI Vendor Homepage: https://github.com/HardySimpson/zlog Software Link: https://github.com/HardySimpson/zlog Version: v1.2.15 Tested on: ubuntu 18.04.2 1.- compile the zlogv1.2.15 code to a library. 2.- Use the "zloginit" API to pars...
PYSEC-2021-809
TensorFlow is an open source platform for machine learning. In affeced versions during execution, EinsumHelper::ParseEquation is supposed to set the flags in inputhasellipsis vector and outputhasellipsis boolean to indicate whether there is ellipsis in the corresponding inputs and output. However...
CVE-2021-41201
TensorFlow is an open source platform for machine learning. In affeced versions during execution, EinsumHelper::ParseEquation is supposed to set the flags in inputhasellipsis vector and outputhasellipsis boolean to indicate whether there is ellipsis in the corresponding inputs and output. However...
CVE-2021-22960
The parse function in llhttp 2.1.4 and 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling HRS under certain conditions...
CVE-2021-22960
The parse function in llhttp 2.1.4 and 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling HRS under certain conditions...
CVE-2021-22960
The parse function in llhttp 2.1.4 and 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling HRS under certain conditions...
Design/Logic Flaw
The parse function in llhttp 2.1.4 and 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling HRS under certain conditions...
CVE-2021-22960
The parse function in llhttp 2.1.4 and 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling HRS under certain conditions...
CVE-2021-22960
The parse function in llhttp 2.1.4 and 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling HRS under certain conditions...
CVE-2021-22960
The parse function in llhttp 2.1.4 and 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling HRS under certain conditions...
CVE-2021-22960
The parse function in llhttp 2.1.4 and 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling HRS under certain conditions...
CVE-2021-22960: Inconsistent Interpretation of HTTP Requests
The parse function in llhttp 2.1.4 and 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling HRS under certain conditions...
PT-2021-5588
Name of the Vulnerable Software and Affected Versions Qualcomm embedded platform software affected versions not specified Description The issue is related to a possible buffer overflow due to the lack of a parameter length check during the MBSSID scan IE parse. This can be exploited by a remote...
PT-2021-11262 · Easy-Xml · Easy-Xml
Name of the Vulnerable Software and Affected Versions: Easy-XML version 0.5.0 Description: The issue allows an attacker to expose sensitive data or perform a denial of service via a crafted external entity entered into the XML content as input. This is due to a XML External Entity XXE vulnerabili...
CLSA-2021-1635459208 Fix CVE(s): CVE-2021-25217
SECURITY UPDATE: buffer overrun in common code parseX - debian/patches/CVE-2021-25217.patch: fix incorrect order of operations in common/parse.c. - CVE-2021-25217...
PT-2021-27873
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read error. Technical details include the crash type and state, which involve functions such as parse...