CVE-2022-1642

A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a JSON document containing a type mismatch. This vulnerability is caused by the interaction between a deserialization mechanism offered by the Swift standard...

grub2: Crafted PNG image may lead to out-of-bound write during huffman table handling

A flaw was found in grub2 when handling a PNG image header. When decoding the data contained in the Huffman table at the PNG file header, an out-of-bounds write may happen on grub's heap...

UBUNTU-CVE-2022-20203

In multiple locations of the nanopb library, there is a possible way to corrupt memory when decoding untrusted protobuf files. This could lead to local escalation of privilege,with no additional execution privileges needed. User interaction is not needed for exploitation...

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL making it a *different* URL usingthe wrong host name when it is later retrieved.For example a URL like `http://example.com%2F127.0.0.1/` would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters checks and more.

...

Denial Of Service (DoS)

github.com/vapor/vapor is vulnerable to denial of service. The vulnerability exists when using automatic decoding in ContentConfiguration which allows an attacker to craft and send a request body which causes a buffer overflow which then leads to an application crash...

PT-2022-14586

Name of the Vulnerable Software and Affected Versions rosariosis versions prior to 9.1 Description A Cross-site Scripting XSS issue exists in the GitHub repository francoisjacquet/rosariosis. The problem arises because HTML entities are not properly decoded from the URL, allowing for stored XSS...

Apache APISIX < 2.13.0 Input Validation

The version of Apache APISIX installed on the remote host is prior to 2.13.0. It is, therefore, potentially affected by an input validation vulnerability. When decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a duplicate key, t...

PT-2022-19479 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.22.1 Description: The issue arises when the OAuth filter attempts to invoke remaining filters in the chain after a local response has been emitted. This can trigger an ASSERT in newer versions and corrupt memory in...

CVE-2022-31019

Vapor is a server-side Swift HTTP web framework. When using automatic content decoding an attacker can craft a request body that can make the server crash with the following request: "curl -d "array00array00array$for f in $seq 1100; do echo -n '00array'; donestring0=hello%20world"...

CVE-2022-31019 DoS Vulnerability in URLEncodedFormDecoder in Vapor

Vapor is a server-side Swift HTTP web framework. When using automatic content decoding an attacker can craft a request body that can make the server crash with the following request: curl -d "array00array00array$for f in $seq 1100; do echo -n '00array'; donestring0=hello%20world"...

PT-2022-20463 · Vapor · Vapor

Name of the Vulnerable Software and Affected Versions: Vapor versions prior to 4.61.1 Description: The issue is related to unbounded, attacker-controlled stack growth, which can lead to a stack overflow and a process crash when using automatic content decoding. An attacker can craft a request bod...

CVE-2022-31019: Buffer Copy without Checking Size of Input

Vapor is a server-side Swift HTTP web framework. When using automatic content decoding an attacker can craft a request body that can make the server crash with the following request: curl -d "array00array00array$for f in $seq 1100; do echo -n '00array'; donestring0=hello%20world"...

CVE-2022-32265

qDecoder before 12.1.0 does not ensure that the percent character is followed by two hex digits for URL decoding...

CVE-2022-32265

qDecoder before 12.1.0 does not ensure that the percent character is followed by two hex digits for URL decoding...

Design/Logic Flaw

qDecoder before 12.1.0 does not ensure that the percent character is followed by two hex digits for URL decoding...

CVE-2022-32265

CVE-2022-32265 affects the qDecoder library prior to version 12.1.0. The root cause is improper URL decoding where a percent character may not be followed by two hex digits, leading to input validation gaps. Affected component: qDecoder (C/C++ CGI library). Impact is described as input validation...

CVE-2022-32265

qDecoder before 12.1.0 does not ensure that the percent character is followed by two hex digits for URL decoding...

CVE-2022-32265

qDecoder before 12.1.0 does not ensure that the percent character is followed by two hex digits for URL decoding...

CVE-2022-32265

qDecoder before 12.1.0 does not ensure that the percent character is followed by two hex digits for URL decoding...

PT-2022-21190

Name of the Vulnerable Software and Affected Versions qDecoder versions prior to 12.1.0 Description The issue arises from the failure to ensure that the percent character is followed by two hex digits for URL decoding. This can lead to potential security issues. Recommendations For versions prior...