AZL-44085 CVE-2020-28500 affecting package js-jquery 3.5.0-4

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service ReDoS via the toNumber, trim and trimEnd functions...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : JUnit 4 vulnerability (USN-4731-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4731-1 advisory. It was discovered that JUnit 4 contains a local information disclosure vulnerability. An attacker could possibly use this issue to obtain...

USN-4731-1: JUnit 4 vulnerability

It was discovered that JUnit 4 contains a local information disclosure vulnerability. An attacker could possibly use this issue to obtain sensitive information...

CVE-2020-25245

A vulnerability has been identified in DIGSI 4 All versions V4.94 SP1 HF 1. Several folders in the %PATH% are writeable by normal users. As these folders are included in the search for dlls, an attacker could place dlls there with code executed by SYSTEM...

Design/Logic Flaw

A vulnerability has been identified in DIGSI 4 All versions V4.94 SP1 HF 1. Several folders in the %PATH% are writeable by normal users. As these folders are included in the search for dlls, an attacker could place dlls there with code executed by SYSTEM...

CVE-2020-25245

A vulnerability has been identified in DIGSI 4 All versions V4.94 SP1 HF 1. Several folders in the %PATH% are writeable by normal users. As these folders are included in the search for dlls, an attacker could place dlls there with code executed by SYSTEM...

CVE-2020-25245

CVE-2020-25245 affects Siemens DIGSI 4 (all versions before v4.94 SP1 HF 1). The root cause is that several folders in %PATH% are writable by normal users and are included in DLL search paths, enabling a local attacker to place DLLs that execute code with SYSTEM privileges. Impact described acros...

Siemens DIGSI 4

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: Siemens Equipment: DIGSI 4 Vulnerability: Incorrect Default Permissions 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a low privileged attacker to execute arbitrary code with SYSTEM...

CentOS 8 : squid:4 (CESA-2020:4743)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4743 advisory. - squid: Improper input validation in request allows for proxy manipulation CVE-2019-12520 - squid: Off-by-one error in addStackElement allows for heap...

CentOS 8 : squid:4 (CESA-2020:2041)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:2041 advisory. - squid: improper check for new member in ESIExpression::Evaluate allows for stack buffer overflow CVE-2019-12519 - squid: parsing of header...

Apple iOS Security Vulnerability

WebKit is a set of open source Web browser engine jointly developed by KDE, Apple Apple, Google Google and other companies. A security vulnerability exists in Apple WebKit, which can be exploited by remote attackers to cause arbitrary code execution. The following products and versions are...

CVE-2021-26271

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs in the Advanced Tab for Dialogs plugin...

DEBIAN-CVE-2021-26271

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs in the Advanced Tab for Dialogs plugin...

CVE-2021-26272

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space in the Autolink plugin...

CVE-2021-26272

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space in the Autolink plugin...

CVE-2021-26272

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space in the Autolink plugin...

CVE-2021-26271

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs in the Advanced Tab for Dialogs plugin...

CVE-2021-26271

CVE-2021-26271 affects CKEditor 4 before 4.16. An attacker could trigger a ReDoS-type DoS by persuading a victim to paste crafted text into the Styles input of dialogs (Advanced Tab in the Dialogs plugin). Affected versions are CKEditor 4.x prior to 4.16; remediation is to upgrade to 4.16 or newe...

OSV-2021-229 Heap-buffer-overflow in cram_xpack_decode_init

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29827 Crash type: Heap-buffer-overflow WRITE 4 Crash state: cramxpackdecodeinit cramdecoderinit cramdecodecompressionheader...

OSV-2021-223 Heap-buffer-overflow in fdilate_1_56

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29819 Crash type: Heap-buffer-overflow READ 4 Crash state: fdilate156 fmorphopgenlow1 pixFMorphopGen1...