c-toxcore 信息泄露漏洞

c-toxcore is a peer-to-peer serverless instant messenger designed to make security and privacy easier for the average user. TokTok c-toxcore suffers from an information disclosure vulnerability that stems from the fact that the Onion module in toxcore prior to version 0.2.2 does not restrict whic...

XML2Dict XML Entity Expansion Vulnerability

XXE vulnerability in 'XML2Dict' version 0.2.2 allows an attacker to cause a denial of service. The parse function does not properly restrict recursive entity references...

PYSEC-2021-349

XXE vulnerability in 'XML2Dict' version 0.2.2 allows an attacker to cause a denial of service...

PYSEC-2021-349

XXE vulnerability in 'XML2Dict' version 0.2.2 allows an attacker to cause a denial of service...

XML2Dict 代码问题漏洞

XML2Dict is an open source python library for converting python dict and XML types. A security vulnerability exists in XML2Dict, which stems from an XXE vulnerability in version 0.2.2 of XML2Dict. An attacker can exploit this vulnerability to cause a denial of service...

RUSTSEC-2021-0146 Crate `twoway` deprecated by the author

The commit e99b3c7 releasing version 0.2.2 explicitly deprecates twoway in favour of memchr crate...

PT-2021-16986 · Npm · Node-Config-Shield

Name of the Vulnerable Software and Affected Versions: node-config-shield versions prior to 0.2.2 Description: The issue concerns the node-config-shield package, where the scripts/cli.js file calls eval when processing a set command. This could potentially lead to issues if the set command is use...

Heap Based Buffer Overflow in libyaml

Versions 0.2.2 and earlier depend on native libyaml version 0.1.5 or earlier. As such, they are affected by a heap-based buffer overflow vulnerability that may result in a crash or arbitrary code execution when parsing YAML tags. Recommendation - Update to version 0.2.3 that includes a version of...

GHSA-P94W-42G3-F7H4 Holder can (re)create authentic credentials after receiving a credential in vp-toolkit

Impact The verifyVerifiableCredential method check the cryptographic integrity of the Verifiable Credential, but it does not check if the credential.issuer DID matches the signer of the credential. The verifier is impacted by this vulnerability. Patches Patch will be available in version 0.2.2...

GHSA-FF5X-W9WG-H275 Holder can generate proof of ownership for credentials it does not control in vp-toolkit

Impact The verifyVerifiablePresentation method check the cryptographic integrity of the Verifiable Presentation, but it does not check if the credentialSubject.id DID matches the signer of the VP proof. The verifier is impacted by this vulnerability. Patches Patch will be available in version...

GNU Serveez Information Disclosure Vulnerability

GNU Serveez is a server framework. An information disclosure vulnerability exists in the httpcgiwrite function in http-cgi.c in GNU Serveez 0.2.2 and earlier. An attacker can exploit this vulnerability to obtain information by sending an HTTP POST request to the /cgi-bin/reader URI...

Heap overflow

GNU Serveez through 0.2.2 has an Information Leak. An attacker may send an HTTP POST request to the /cgi-bin/reader URI. The attacker must include a Content-length header with a large positive value that, when represented in 32 bit binary, evaluates to a negative number. The problem exists in the...

CVE-2019-15111

The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue...

High severity vulnerability that affects many_versioned_gem

Logs password in plaintext Impact Logs the password used in plaintext. The password should masked in logs to prevent it leaking. Patches Has the problem been patched? What versions should users upgrade to? Workarounds none See also Are there any links users can visit to find out more information?...

CVE-2018-16473

A path traversal in takeapeek module versions =0.2.2 allows an attacker to list directory and files...

Design/Logic Flaw

The 1 ptyinitterminal and 2 pipeinitterminal functions in main.c in s3dvt 0.2.2 and earlier allows local users to gain privileges by leveraging setuid permissions and usage of bash 4.3 and earlier. NOTE: this vulnerability was fixed with commit ad732f00b411b092c66a04c359da0f16ec3b387, but the...

CVE-2013-6876

The 1 ptyinitterminal and 2 pipeinitterminal functions in main.c in s3dvt 0.2.2 and earlier allows local users to gain privileges by leveraging setuid permissions and usage of bash 4.3 and earlier. NOTE: this vulnerability was fixed with commit ad732f00b411b092c66a04c359da0f16ec3b387, but the...

MLAlchemy Command Execution Vulnerability

MLAlchemy is a Python based open source utility library that converts YAML/JSON to SQLAlchemy SELECT queries. A security vulnerability exists in the YAML parsing functionality of the parseyamlquery method of the arser.py file in versions of MLAlchemy prior to 0.2.2. An attacker can exploit this...

CVE-2017-16615

An exploitable vulnerability exists in the YAML parsing functionality in the parseyamlquery method in parser.py in MLAlchemy before 0.2.2. When processing YAML-Based queries for data, a YAML parser can execute arbitrary Python commands resulting in command execution because load is used where...

openSite 0.2.2 beta - Local File Inclusion Vulnerbility

No description provided by source. opensite-v0.2.2-beta === Local File Include vuln By n0n0x Homepage: http://priasantai.uni.cc/ Download script :http://sourceforge.net/projects/contentone/files/openSite/opensite-v0.2.2-beta/opensite-v0.2.2-beta.zip/download...