CVE-2021-4278 cronvel tree-kit prototype pollution

A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x. This affects an unknown part. The manipulation leads to improperly controlled modification of object prototype attributes 'prototype pollution'. Upgrading to version 0.7.0 is able to address this issue. The...

Tree Kit 安全漏洞

Tree Kit is a toolkit for Cedric Ronvel's personal developers that provides functions that operate with nested object structures. A security vulnerability exists in Tree Kit versions prior to 0.7.0, which stems from a vulnerability that can lead to improperly controlled modification of an object'...

PT-2022-11686 · Unknown · Cronvel Tree-Kit

Name of the Vulnerable Software and Affected Versions: cronvel tree-kit versions up to 0.6.x Description: A problematic vulnerability has been found, affecting an unknown part of the software. The issue leads to improperly controlled modification of object prototype attributes, also known as...

CVE-2022-41974

multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege...

GHSA-PCJH-6R5H-R92R django-sendfile2 before 0.7.0 contains reflected file download vulnerability

Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an attack. A new version of...

CVE-2022-0085

Server-Side Request Forgery SSRF in GitHub repository dompdf/dompdf prior to 2.0.0...

GHSA-RVGF-69J7-XH78 Uncontrolled Resource Consumption in @discordjs/opus

Improperly handled errors in @discordjs/opus cause hard crashes instead of returning the error to user land. All versions of package @discordjs/opus = 0.7.0 are vulnerable to Denial of Service DoS when trying to encode using an encoder with zero channels, or a non-initialized buffer. This leads t...

Default configuration

NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to block sensitive cookies e.g. session cookies from being forwarded to backend services configured by the application developer. This could have led to sensitive cooki...

GHSA-9XWQ-72VP-5J3C Cross-site Scripting in Apache Atlas

Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to DOM XSS in the edit-tag functionality...

[SECURITY] Fedora 36 Update: golang-github-containerd-stargz-snapshotter-0.7.0-4.fc36

Fast container image distribution plugin with lazy pulling...

[SECURITY] Fedora 34 Update: golang-github-containerd-stargz-snapshotter-0.7.0-4.fc34

Fast container image distribution plugin with lazy pulling...

[SECURITY] Fedora 35 Update: golang-github-theupdateframework-notary-0.7.0-4.fc35

The Notary project comprises a server and a client for running and interacting with trusted collections. See the service architecture documentation for more information. Notary aims to make the internet more secure by making it easy for people to publish and verify content. We often rely on TLS t...

PT-2022-18842 · Jenkins · Jenkins Proxmox Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Proxmox Plugin version 0.7.0 and earlier Description: A cross-site request forgery CSRF issue allows attackers to connect to a specified host using a specified username and password, disable SSL/TLS validation for the entire Jenkins...

Out-of-bounds

njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njsvmcodetypeof in /src/njsvmcode.c...

CVE-2022-25139

njs through 0.7.0, used in NGINX, was discovered to contain a heap use-after-free in njsawaitfulfilled...

Nginx njs 资源管理错误漏洞

Nginx is a lightweight web server/reverse proxy server and email IMAP/POP3 proxy server from the US-based Nginx Corporation. A resource management error vulnerability exists in Nginx njs 0.7.0 and earlier versions, which stems from njs including a heap use-after-free in njsawaitfulfilled...

Rust 缓冲区错误漏洞

Rust, a general-purpose, compiled programming language from the Mozilla Foundation, has a security vulnerability in versions prior to Rust metrics-util crate 0.7.0 that can be exploited by attackers to cause memory corruption...

WordPress plugin跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in...

Mozilla Rust Memory Corruption Vulnerability (CNVD-2021-71650)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability in Rust rusb crate before 0.7.0, which stems from a lack of send and synchronization restrictions, can be exploited by an attacker to cause data contention and memory corruption...

CVE-2021-32796

xmldom is an open source pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes duri...