CVE-2021-3561

An Out of Bounds flaw was found fig2dev version 3.2.8a. A flawed bounds check in readobjects could allow an attacker to provide a crafted malicious input causing the application to either crash or in some cases cause memory corruption. The highest threat from this vulnerability is to integrity as...

Input validation

golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service infinite loop via crafted ParseFragment input...

Regular Expression Denial of Service (ReDoS)

Overview trim-off-newlines is a Similar to Stringtrim but removes only newlines Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via string processing. PoC const trim = require'trim-off-newlines'; for let i=10; i 25; i += 1 const s = 'a' + "rn".repeat...

Regular Expression Denial of Service (ReDoS)

Overview ansi-html is an An elegant lib that converts the chalked ANSI text to HTML. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time. PoC...

The vulnerability of the webSettingProfileGeneral function in the embedded web server software is related to buffer overflows in the stack due to deficiencies in input data processing. This allows attackers to execute arbitrary code or cause service interruptions by exploiting this vulnerability.

The vulnerability of the webSettingProfileGeneral function in the embedded web server software is related to buffer overflows in the stack due to deficiencies in input data processing. Exploiting this vulnerability can allow an attacker to enhance their privileges, execute arbitrary code, or caus...

CVE-2021-22339

There is a denial of service vulnerability in some versions of ManageOne. In specific scenarios, due to the insufficient verification of the parameter, an attacker may craft some specific parameter. Successful exploit may cause some services abnormal...

CVE-2021-3517

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this...

DEBIAN-CVE-2021-3518

There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability...

GNU LibreDWG Memory Leak Vulnerability

LibreDWG is a free C library for reading and writing DWG files. GNU LibreDWG version 0.10 in dwgdecodeeed ... /... A memory leak vulnerability exists in /src/decode.c:3638. An attacker could cause a memory leak by exploiting this vulnerability via specially crafted input...

Liferay Portal and Liferay DXP have unspecified vulnerabilities (CNVD-2021-62988)

Liferay Portal and Liferay DXP are both products of Liferay, a J2EE-based portal solution that uses EJB and JMS technologies and serves as a web publishing and shared workspace, enterprise collaboration platform, social network, etc. Liferay DXP is a digital experience collaboration platform...

USN-4958-1 caribou vulnerability

It was discovered that the Caribou onscreen keyboard could be made to crash when given certain input values. An attacker could use this to bypass screen-locking applications that support using Caribou as an input mechanism...

PT-2021-10684

Name of the Vulnerable Software and Affected Versions: GNU LibreDWG version 0.10 Description: An issue in GNU LibreDWG leads to a memory leak when crafted input is processed by the dwg decode eed function in the decode.c file. Recommendations: For GNU LibreDWG version 0.10, at the moment, there i...

GNU LibreDWG 安全漏洞

LibreDWG is a free C library for reading and writing DWG files. GNU LibreDWG version 0.10 in dwgdecodeeed ... /... A memory leak vulnerability exists in /src/decode.c:3638. An attacker could cause a memory leak by exploiting this vulnerability via specially crafted input...

Liferay Portal 安全漏洞

Liferay Portal and Liferay DXP are both products of Liferay, a J2EE-based portal solution that uses EJB and JMS technologies and serves as a web publishing and shared workspace, enterprise collaboration platform, social network, etc. Liferay DXP is a digital experience collaboration platform...

PYSEC-2021-470

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow by passing crafted inputs to tf.rawops.StringNGrams. This is because the...

PYSEC-2021-741

TensorFlow is an end-to-end open source platform for machine learning. The implementation of ParseAttrValuehttps://github.com/tensorflow/tensorflow/blob/c22d88d6ff33031aa113e48aa3fc9aa74ed79595/tensorflow/core/framework/attrvalueutil.ccL397-L453 can be tricked into stack overflow due to recursion...

PYSEC-2021-179

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow by passing crafted inputs to tf.rawops.StringNGrams. This is because the...

CVE-2021-29615

TensorFlow is an end-to-end open source platform for machine learning. The implementation of ParseAttrValuehttps://github.com/tensorflow/tensorflow/blob/c22d88d6ff33031aa113e48aa3fc9aa74ed79595/tensorflow/core/framework/attrvalueutil.ccL397-L453 can be tricked into stack overflow due to recursion...

Google TensorFlow 缓冲区错误漏洞

Google TensorFlow is an end-to-end open source machine learning platform. A security vulnerability exists in Google TensorFlow StringNGrams. An attacker can exploit the vulnerability by passing specially crafted input to tf.rawops.StringNGrams to cause a heap buffer overflow...

PT-2021-18277 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2 and earlier TensorFlow versions 2.3.3 and earlier TensorFlow versions 2.2.3 and earlier TensorFlow versions 2.1.4 and earlier Description: An attacker can trigger a division by 0 in...