PT-2021-7865

Name of the Vulnerable Software and Affected Versions ezXML version 0.8.6 Description The issue is related to the ezxml parse str function in the ezXML library, which performs incorrect memory handling while parsing crafted XML files, leading to an out-of-bounds read after a certain strcspn...

7ghost (>=4.11.0, <=4.11.46), @0x18b2ee/parse-server (>=3.10.1, <=3.11.0) +2856 more potentially affected by CVE-2021-28918 +1 more via netmask (>=1.0.4, <=1.0.6)

netmask NPM version =1.0.4, =4.11.0, =3.10.1, =0.1.0, =0.1.0, =1.6.1, =0.0.1, =2.0.0, =0.0.9, =0.0.175, =0.0.81, =2.0.0, =0.9.17-pre.6, =1.0.5 and more Source cves: CVE-2021-28918, CVE-2021-29418 Source advisory: OSV:GHSA-4C7M-WXVM-R7GC...

CVE-2021-0427

In parseExclusiveStateAnnotation of LogEvent.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

OESA-2021-1125 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

minify:parse-css-token: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5720301578092544 Project: minify Fuzzing Engine: libFuzzer Fuzz Target: parse-css-token Job Type: libfuzzerasanminify Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xffffffffffffffff Crash State: NULL Sanitizer: address ASAN...

CVE-2021-27698

RIOT-OS 2021.01 contains a buffer overflow vulnerability in /sys/net/gnrc/routing/rpl/gnrcrplcontrolmessages.c through the parseoptions function...

CVE-2021-27698

RIOT-OS 2021.01 contains a buffer overflow vulnerability in /sys/net/gnrc/routing/rpl/gnrcrplcontrolmessages.c through the parseoptions function...

RIOT RIOT-OS 安全漏洞

RIOT is a real-time multi-threaded IoT operating system that supports a range of devices commonly found in the Internet of Things. A buffer overflow vulnerability exists in the parseoptions function in /sys/net/gnrc/routing/rpl/gnrcrplcontrolmessages.c in RIOT version 2021.01. No detailed...

PT-2021-17607

Name of the Vulnerable Software and Affected Versions: RIOT-OS version 2021.01 Description: The issue is related to a buffer overflow in the parse options function, located in the /sys/net/gnrc/routing/rpl/gnrc rpl control messages.c file. Recommendations: For RIOT-OS version 2021.01, consider...

PT-2021-8037

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the validation of UDP retransmission in the Linux kernel's NFS module. Specifically, it concerns the xprt calc majortimeo function, where a shift out-of-bounds...

CVE-2021-29932

An issue was discovered in the parseduration crate through 2021-03-18 for Rust. It allows attackers to cause a denial of service CPU and memory consumption via a duration string with a large exponent...

CVE-2021-29932

An issue was discovered in the parseduration crate through 2021-03-18 for Rust. It allows attackers to cause a denial of service CPU and memory consumption via a duration string with a large exponent...

gpac:fuzz_parse: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6389891240951808 Project: gpac Fuzzing Engine: libFuzzer Fuzz Target: fuzzparse Job Type: libfuzzerubsangpac Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7f9f9f84ddb0 Crash State: NULL Sanitizer: undefined UBSAN Recommended Securi...

Remote Code Execution (RCE)

@thi.ng/egf is vulnerable to remote code execution. The vulnerability exists due to EGF parse function attempting to decrypt values...

Design/Logic Flaw

Potential for arbitrary code execution in npm package @thi.ng/egf gpg-tagged property values only if decrypt: true option is enabled. PR with patch has been submitted and will has been released as of v0.4.0 By default the EGF parse functions do NOT attempt to decrypt values since GPG only availab...

DEBIAN-CVE-2020-24994

Stack overflow in the parsetag function in libass/assparse.c in libass before 0.15.0 allows remote attackers to cause a denial of service or remote code execution via a crafted file...

UBUNTU-CVE-2020-24994

Stack overflow in the parsetag function in libass/assparse.c in libass before 0.15.0 allows remote attackers to cause a denial of service or remote code execution via a crafted file...

The vulnerability in the `dns_parse_callback` function in the `network/lookup_name.c` library for the C language, used in Linux-based embedded operating systems, allows a attacker to cause a service failure.

The vulnerability of the dnsparsecallback function in the network/lookupname.c library for the C language, used in Linux-based operating systems, relates to the lack of restrictions on the number of addresses that can be entered. Exploiting this vulnerability could allow a remote attacker to caus...

CVE-2019-9636

It was discovered that python's functions urllib.parse.urlsplit and urllib.parse.urlparse do not properly handle URLs encoded with Punycode/Internationalizing Domain Names in Applications IDNA, which may result in a wrong domain name specifically the netloc component of URL - user@domain:port bei...

PT-2021-28164

Name of the Vulnerable Software and Affected Versions: OpenSSL affected versions not specified Description: A heap buffer overflow read issue has been identified. The crash state indicates the involvement of specific functions: sc pkcs15emu oberthur add pubkey, sc oberthur parse publicinfo, and s...