PT-2020-18966

Name of the Vulnerable Software and Affected Versions Accusoft ImageGear version 19.7 Description A code execution issue exists in the DICOM parse dicom meta info functionality. It can be triggered by a specially crafted malformed file, causing an out-of-bounds write. An attacker can exploit this...

Mozilla: Out of bound read in Date.parse()

Due to confusion processing a hyphen character in Date.parse, a one-byte out of bounds read could have occurred, leading to potential information disclosure. This vulnerability affects Firefox 78...

Mozilla: Out of bound read in Date.parse()

Due to confusion processing a hyphen character in Date.parse, a one-byte out of bounds read could have occurred, leading to potential information disclosure. This vulnerability affects Firefox 78...

OSV-2020-1659 Use-of-uninitialized-value in LibRaw::parse_sinar_ia

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25188 Crash type: Use-of-uninitialized-value Crash state: LibRaw::parsesinaria LibRaw::identify LibRaw::opendatastream...

PT-2020-21931

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read, as indicated by an OSS-Fuzz report. The crash state involves functions such as macho is 32, macho pars...

Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number which triggers a heap-based buffer overflow.

...

CVE-2020-7702

All versions of package templ8 are vulnerable to Prototype Pollution via the parse function...

CVE-2020-7702

All versions of package templ8 are vulnerable to Prototype Pollution via the parse function...

CVE-2020-7702

All versions of package templ8 are vulnerable to Prototype Pollution via the parse function...

Prototype Pollution

Overview Templ8 is a JavaScript Client/ Server Template Engine Affected versions of this package are vulnerable to Prototype Pollution via the parse function. POC const Templ8 = require'Templ8'; var tpl = new Templ8 'proto.polluted=true' ; tpl.parse; console.logpolluted //true Details Prototype...

PT-2020-19725 · Npm · Templ8

Name of the Vulnerable Software and Affected Versions: templ8 versions prior to 0.0.45 Description: The issue concerns Prototype Pollution via the parse function. This affects all versions of the templ8 package up to and including 0.0.44. Recommendations: For versions prior to 0.0.45, update to...

CVE-2020-7702: Improperly Controlled Modification of Object Prototype Attributes

All versions of package templ8 are vulnerable to Prototype Pollution via the parse function...

Prototype Pollution

Overview locutus is a Locutus other languages' stadard libraries to JavaScript for fun and educational purposes Affected versions of this package are vulnerable to Prototype Pollution via the php.strings.parsestr function. POC: const locutus = require'locutus';...

PT-2020-19723 · Phpjs · Phpjs

Name of the Vulnerable Software and Affected Versions: phpjs versions prior to 1.3.2 and possibly later, as all versions are mentioned as vulnerable in one source, but another source specifies up to 1.3.2. Description: The issue concerns Prototype Pollution via the parse str function. This affect...

The vulnerability of the parse_query method (class-wp-query.php) in the WordPress content management system allows a hacker to access confidential data.

The vulnerability of the parsequery method class-wp-query.php in the WordPress content management system is related to the lack of protection for sensitive data. Exploiting this vulnerability could allow a malicious actor to gain access to confidential information...

PT-2020-15697

Name of the Vulnerable Software and Affected Versions njs versions through 0.4.3 Description The issue is related to a use-after-free in the njs json parse iterator call function in njs json.c. This affects njs, which is used in NGINX. Recommendations For versions through 0.4.3, update to a versi...

The vulnerability of the parse_report() function in the whoopsie error logging service allows a violator to trigger a service failure.

The vulnerability of the parsereport function in the whoopsie error reporting service is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a perpetrator to cause a service failure using a specially crafted file...

PT-2020-15022

Name of the Vulnerable Software and Affected Versions radare2 version 4.5.0 Description The issue is caused by radare2 misparsing signature information in PE files, leading to a segmentation fault in the r x509 parse algorithmidentifier function in libr/util/x509.c. This occurs due to a malformed...

CVE-2020-11937

In whoopsie, parsereport from whoopsie.c allows a local attacker to cause a denial of service via a crafted file. The DoS is caused by resource exhaustion due to a memory leak. Fixed in 0.2.52.5ubuntu0.5, 0.2.62ubuntu0.5 and 0.2.69ubuntu0.1...

Command Injection

Overview json is a 'json' command tool for massaging and processing JSON on the command line. Affected versions of this package are vulnerable to Command Injection. It is possible to inject arbritary commands using the parseLookup function. PoC const json = require'json'; res =...