CVE-2021-40660

An issue was discovered in Delight Nashorn Sandbox 0.2.0. There is an ReDoS vulnerability that can be exploited to launching a denial of service DoS attack...

Delight Nashorn Sandbox 安全漏洞

Delight Nashorn Sandbox is a sandbox for executing JavaScript in Java using Nashorn from Java Delight A denial of service vulnerability exists in Delight Nashorn Sandbox version 0.2.0, which stems from a weak expression that can be exploited and can be used by an attacker to The vulnerability lea...

PT-2022-11294 · Unknown · Delight Nashorn Sandbox

Name of the Vulnerable Software and Affected Versions: Delight Nashorn Sandbox version 0.2.0 Description: An issue was discovered in Delight Nashorn Sandbox, which has a ReDoS vulnerability that can be exploited to launch a denial of service DoS attack. Recommendations: For Delight Nashorn Sandbo...

@apsis/cli (=0.5.0), @asmallstudio/utilities (>=0.2.2 <=0.3.3) +121 more potentially affected by CVE-2022-24376 via git-promise (>=0.2.0 <=1.0.0)

git-promise NPM version =0.2.0, =0.2.2, =1.1.8, =1.0.0, =2.0.0-beta.10, =1.0.13, =1.0.0, =0.0.8, =1.1.1 - @efox/eslint-config-react-prittier-ts =1.0.19 - @efox/pay =1.0.8 - @efox/plugin-babel-react =1.0.1 - @emfc/emfc-cli =1.1.0 and more Source cves: CVE-2022-24376 Source advisory:...

Privilege escalation in Hashicorp Nomad

HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation through the artifact stanza in submitted jobs onto the client agent host. Fixed in 1.1.14, 1.2.8, and 1.3.1...

Design/Logic Flaw

HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation through the artifact stanza in submitted jobs onto the client agent host. Fixed in 1.1.14, 1.2.8, and 1.3.1...

GHSA-XQPP-26PP-2365 XSS vulnerability in Jenkins Markdown Formatter Plugin

Jenkins Markdown Formatter Plugin 0.1.0 and earlier uses a Markdown library to parse Markdown that does not escape crafted link target URLs. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with the ability to edit any description rendered using the...

GHSA-7H48-M3RW-VR27 Spree does not properly restrict the use of a hash to provide values for a model's attributes

Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability...

Spree does not properly restrict the use of a hash to provide values for a model's attributes

Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability...

django-kb (>=0.1.0 <=0.2.0) potentially affected by CVE-2015-0846 via django-markupfield (=1.2.1)

django-markupfield PYPI version =1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-markupfield and may be impacted: - django-kb =0.1.0, =0.2.0 Source cves: CVE-2015-0846 Source advisory: OSV:GHSA-WXMR-7XJV-8XQW...

Improper Input Validation in pyftpdlib

FTPServer.py in pyftpdlib before 0.2.0 allows remote attackers to cause a denial of service via a long command...

UBUNTU-CVE-2021-44847

A stack-based buffer overflow in handlerequest function in DHT.c in toxcore 0.1.9 through 0.1.11 and 0.2.0 through 0.2.12 caused by an improper length calculation during the handling of received network packets allows remote attackers to crash the process or potentially execute arbitrary code via...

@deansel/latte (>=0.1.2-beta.1 <=0.1.2-beta.7), @ibuk/epubjs-rn (>=0.2.40 <=0.2.43) +49 more potentially affected by CVE-2021-3820 via i (>=0.2.0 <=0.3.6)

i NPM version =0.2.0, =0.1.2-beta.1, =0.2.40, =0.2.38, =0.3.25, =0.2.33, =4.0.0-beta.6, =0.2.5, =0.6.0, =0.1.5, =0.0.2, =0.2.37, =0.0.1, =0.0.3 and more Source cves: CVE-2021-3820 Source advisory: OSV:GHSA-X55W-VJJP-222R...

zdd (=0.2.0) potentially affected by CVE-2020-36215 via hashconsing (=0.10.3)

hashconsing CARGO version =0.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on hashconsing and may be impacted: - zdd =0.2.0 Source cves: CVE-2020-36215 Source advisory: OSV:GHSA-RW2C-C256-3R53...

PYSEC-2021-371

BinderHub is a kubernetes-based cloud service that allows users to share reproducible interactive computing environments from code repositories. In affected versions a remote code execution vulnerability has been identified in BinderHub, where providing BinderHub with maliciously crafted input...

BinderHub 操作系统命令注入漏洞

BinderHub is a kubernetes-based cloud service that allows users to share replicable interactive computing environments from a codebase. BinderHub suffers from an operating system command injection vulnerability. An attacker can exploit this vulnerability to execute code in the BinderHub context a...

Advisory ROSA-SA-2021-1962

Software: rpcbind 0.2.0 OS: Cobalt 7.9 CVE-ID: CVE-2017-8779 CVE-Crit: HIGH CVE-DESC: rpcbind before 0.2.4, LIBTIRPC before 1.0.1 and 1.0.2-rc before 1.0.2-rc3 and NTIRPC before 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, allowing remote attackers to...

Advisory ROSA-SA-2021-1840

Software: gegl 0.2.0 OS: Cobalt 7.9 CVE-ID: CVE-2018-10111 CVE-Crit: HIGH CVE-DESC: An issue was discovered in GEGL before version 0.3.32. The renderrectangle function in process / gegl-processor.c has unlimited memory allocation, which causes a denial of service application crash if the allocati...

RPCBind 0.2.0 Multiple Vulnerabilities

RPCBind is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2021-21269

Keymaker is a Mastodon Community Finder based Matrix Community serverlist page Server. In Keymaker before version 0.2.0, the assets endpoint did not check for the extension. The rust join method without checking user input might have made it abe to do a Path Traversal attack causing to read more...