968 matches found
PYSEC-2020-149
The encodeinvalidchars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service CPU consumption because of an inefficient algorithm. The percentencodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length ...
UBUNTU-CVE-2020-7212
The encodeinvalidchars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service CPU consumption because of an inefficient algorithm. The percentencodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length ...
Updated dojo packages fix security vulnerability
Updated dojo package fixes security vulnerability: dojox was vulnerable to Cross-site Scripting. This was due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them CVE-2019-10785...
PT-2020-5140
Name of the Vulnerable Software and Affected Versions urllib3 library versions 1.25.2 through 1.25.7 Description The issue is related to an inefficient algorithm in the encode invalid chars function, which can lead to a denial of service due to CPU consumption. This happens because the percent...
UBUNTU-CVE-2019-10785
dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them...
CVE-2019-10785
CVE-2019-10785 affects the Dojo/Dojox component, where dojox.xmpp.util.xmlEncode only encodes the first occurrence of each character, enabling cross-site scripting in affected Dojo versions prior to 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. The connected IBM and Nessus entries corroborat...
Cross-site Scripting (XSS)
Overview dojox is a dojo extension, a rollup of many useful sub-projects and varying states of maturity, from very stable and robust, to alpha and experimental. Affected versions of this package are vulnerable to Cross-site Scripting XSS. dojox.xmpp.util.xmlEncode only encodes the first occurrenc...
CVE-2014-9629
Integer overflow in the Encode function in modules/codec/schroedinger.c in VideoLAN VLC media player before 2.1.6 and 2.2.x before 2.2.1 allows remote attackers to conduct buffer overflow attacks and execute arbitrary code via a crafted length value...
DEBIAN-CVE-2014-9629
Integer overflow in the Encode function in modules/codec/schroedinger.c in VideoLAN VLC media player before 2.1.6 and 2.2.x before 2.2.1 allows remote attackers to conduct buffer overflow attacks and execute arbitrary code via a crafted length value...
Integer overflow
Integer overflow in the Encode function in modules/codec/schroedinger.c in VideoLAN VLC media player before 2.1.6 and 2.2.x before 2.2.1 allows remote attackers to conduct buffer overflow attacks and execute arbitrary code via a crafted length value...
UBUNTU-CVE-2014-9629
Integer overflow in the Encode function in modules/codec/schroedinger.c in VideoLAN VLC media player before 2.1.6 and 2.2.x before 2.2.1 allows remote attackers to conduct buffer overflow attacks and execute arbitrary code via a crafted length value...
CVE-2014-9629
Integer overflow in the Encode function in modules/codec/schroedinger.c in VideoLAN VLC media player before 2.1.6 and 2.2.x before 2.2.1 allows remote attackers to conduct buffer overflow attacks and execute arbitrary code via a crafted length value...
PT-2019-15987 · FFmpeg · Ffjpeg
Name of the Vulnerable Software and Affected Versions: ffjpeg through 2019-08-21 Description: The issue is related to a NULL pointer dereference in the bitstr tell function at bitstr.c, specifically concerning jfif encode. Recommendations: For versions through 2019-08-21, at the moment, there is ...
EulerOS 2.0 SP3 : perl (EulerOS-SA-2019-2648)
According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - 1 cpan/Archive-Tar/bin/ptar, 2 cpan/Archive-Tar/bin/ptardiff, 3 cpan/Archive-Tar/bin/ptargrep, 4 cpan/CPAN/scripts/cpan, 5 cpan/Digest-SHA/shasum,...
libsixel Input Validation Error Vulnerability
libsixel is a package that provides encoding/decoding implementations for DEC SIXEL graphics and other converter programs. An input validation error vulnerability exists in the 'sixelencodebody' function of the tosixel.c file in libsixel version 1.8.2. The vulnerability stems from a networked...
UBUNTU-CVE-2019-19636
An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixelencodebody at tosixel.c...
PT-2019-15895 · Libsixel +1 · Libsixel +1
Name of the Vulnerable Software and Affected Versions: libsixel version 1.8.2 Description: An issue was discovered in the function sixel encode body at tosixel.c, which is affected by an integer overflow. Recommendations: For libsixel version 1.8.2, at the moment, there is no information about a...
Ruby on Rails: The authenticity_token can be reversed and used to forge valid per_form_csrf_tokens for arbitrary routes
When performcsrftokens is set to true, each form should protected against CSRF with a unique token that is not predictable by an attacker. Theperformcsrftoken is generated using a HMAC SHA-256 using a key that is exposed in a reversed authenticitytoken. The authenticitytoken is a Base64 encoding ...
EulerOS 2.0 SP5 : perl (EulerOS-SA-2019-2220)
According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to...