CVE-2023-30858 Denosaurs emoji has ReDoS vulnerability in `replace` function

The Denosaurs emoji package provides emojis for dinosaurs. Starting in version 0.1.0 and prior to version 0.3.0, the reTrimSpace regex has 2nd degree polynomial inefficiency, leading to a delayed response given a big payload. The issue has been patched in 0.3.0. As a workaround, avoid using the...

emoji 安全漏洞

emoji is a simple emoticon from the Denosaurs team that supports the node.js project. A security vulnerability exists in Denosaurs emoji version 0.1.0 up to and including version 0.3.0, which stems from an inefficient second-order polynomial in a regular expression, resulting in a delayed respons...

Bare Metal Operator 信息泄露漏洞

Bare Metal Operator is an open source application from Metal³ that uses the Kubernetes API to manage bare metal hosts. An information disclosure vulnerability exists in Bare Metal Operator versions prior to 0.3.0, which stems from the presence of plaintext username and hashed password disclosure...

WordPress plugin Random Text SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

PT-2023-16236 · WordPress · The Random Text Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Random Text WordPress plugin versions through 0.3.0 Description: The issue is related to a SQL injection that occurs because a parameter is not properly sanitized and escaped before being used in a SQL statement. This can be exploited by...

GHSA-H384-PH77-3699 weixin-python XML External Entity vulnerability

A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/toxml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgrading to version 0.5.5 is able to address this issue. The name...

CVE-2018-25082

A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/toxml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgrading to version 0.5.5 is able to address this issue. The patc...

CVE-2018-25082

CVE-2018-25082 affects zwczou WeChat SDK Python 0.3.0. Root cause: XML External Entity (XXE) reference via validate/to_xml, enabling remote manipulation. Impact as described: potential impact on confidentiality, integrity, and availability due to unresolved external entities. Public details indic...

weixin-python 代码问题漏洞

Python is an open source, object-oriented programming language from the Python Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. A code issue vulnerability exists in weixin-python version 0.3.0, which stems from the presence of xml external...

PT-2023-19479 · Davinci · Davinci

Name of the Vulnerable Software and Affected Versions: Davinci version 0.3.0-rc Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the copyDisplay function. Recommendations: For Davinci version 0.3.0-rc, consider disabling the copyDisplay...

SUSE CVE-2017-6831

Heap-based buffer overflow in the decodeBlockWAVE function in IMA.cpp in Audio File Library aka audiofile 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0 and 0.2.7 allows remote attackers to cause a denial of service crash via a crafted file...

CVE-2023-24623

Paranoidhttp before 0.3.0 allows SSRF because :: is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses...

CVE-2022-41967

Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XML external entity XXE attacks. This issue is patched in 0.3.1-SNAPSHOT. As a workaround, since Dragonfly only parses XML SNAPSHOT versions are being resolved...

CVE-2022-23542 OpenFGA Authorization Bypass

OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered that OpenFGA version 0.3.0 is vulnerable to authorization bypass under certain conditions. This issue has been patched in version 0.3.1 and...

PT-2022-16063 · Openfga · Openfga

Name of the Vulnerable Software and Affected Versions: OpenFGA version 0.3.0 Description: OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered that OpenFGA is vulnerable to authorization bypas...

SAMSUNG mTower 缓冲区错误漏洞

SAMSUNG mTower is a new Trusted Execution Environment TEE from Samsung South Korea. A security vulnerability exists in SAMSUNG mTower versions prior to 0.3.0, which stems from a buffer access in its TEEMACComputeFinal function with an incorrect length value vulnerability that allows a trusted...

SAMSUNG mTower 输入验证错误漏洞

SAMSUNG mTower is a new Trusted Execution Environment TEE from Samsung South Korea. A security vulnerability in SAMSUNG mTower versions prior to 0.3.0, which stems from an incorrect input validation vulnerability in its teeobjfree function, allows a trusted application to trigger a denial of...

PT-2022-25521 · Samsung · Samsung Mtower

Name of the Vulnerable Software and Affected Versions: Samsung mTower versions 0.3.0 and earlier Description: A Buffer Access with Incorrect Length Value issue in the TEE MACUpdate function allows a trusted application to trigger a Denial of Service DoS by invoking the function TEE MACUpdate with...

PT-2022-25019 · Samsung · Samsung Mtower

Name of the Vulnerable Software and Affected Versions: Samsung mTower versions 0.3.0 and earlier Description: The issue is related to a NULL pointer dereference in the aes256 encrypt function due to a missing check on the return value of EVP CIPHER CTX new. Recommendations: For Samsung mTower...

SAMSUNG mTower 代码问题漏洞

SAMSUNG mTower is a new Trusted Execution Environment TEE from Samsung South Korea. A security vulnerability exists in SAMSUNG mTower 0.3.0 and earlier versions, which stems from a lack of checking of the return value of EVPCIPHERCTXnew and a NULL pointer dereference in aes256encrypt...