docconv security vulnerabilities

docconv is Search.io open source a library . PDF, DOC, DOCX, XML, HTML, RTF , etc. will be converted to plain text . docconv 1.2.0 and previous versions of a security vulnerability , the vulnerability stems from its ConvertDocx/ConvertODT/ConvertPages/ConvertXML/XMLToText function of the operatio...

PT-2022-27670 · Unknown · Planet Estream

Name of the Vulnerable Software and Affected Versions: Planet eStream versions prior to 6.72.10.07 Description: The issue allows attackers to call restricted functions and perform unauthenticated uploads via the "Upload2.ashx" endpoint or access content uploaded by other users through "View.aspx"...

OESA-2023-1219 sqlite security update

SQLite is a C-language library that implements a small, fast, self-contained, high-reliability, full-featured, SQL database engine. SQLite is the most used database engine in the world. SQLite is built into all mobile phones and most computers and comes bundled inside countless other applications...

ROS-20221222-05

A vulnerability in the compiling Twig template handler exists due to failure to take measures to neutralize the special elements. Exploitation of the vulnerability could allow an attacker acting remotely, affect the confidentiality, integrity and availability of protected information by running...

Extensive permissions for owner

Lines of code Vulnerability details Impact & Proof Of Concepts / Implications Some privileged functions are often unavoidable in smart contracts. However, in these contracts, the privileges are unnecessarily very extensive and without checks on the smart contract side: 1. He can use ownerMint or...

Unsanitized input returned in response is conducive to XSS exploitation

Description During the initial installation process it was identified that the "Create user" form that collects user data, does not properly sanitize the data entry and then prints them on the screen with an error message without any apparent validation, thus allowing the insertion of HTML or...

Pair.sol has payable functions with no way of withdrawing that ether

Lines of code Vulnerability details Pair.sol has payable functions with no way of withdrawing that ether Summary Value is deposited on the contract using payable functions but later can't be taken out Impact Locked ether Proof of Concept Pair.adduint256,uint256,uint256 Pair.buyuint256,uint256...

SQLite through 3.40.0 when relying on --safe for execution of an untrusted CLI script does not properly implement the azProhibitedFunctions protection mechanism and instead allows UDF functions such as WRITEFILE.

...

UBUNTU-CVE-2022-46908

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE...

CVE-2022-46908: Undefined Security Weakness

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE...

CVE-2022-46908

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE...

PT-2022-6939

Name of the Vulnerable Software and Affected Versions SQLite versions prior to 3.40.0 Description The issue is related to errors in the implementation of the azAllowedFunctions protection mechanism in the SQLite database management system's command-line interface. This could allow an attacker to...

Changes not being stored in Delta.sol

Lines of code Vulnerability details Changes not being stored in Delta.sol Impact Functions working without proper storage dealing into unexpected behaviors Proof of Concept function combineInstance memory self, Instance memory delta internal pure if !self.skipCombine self.deltaInBinInternal +=...

SQLite security vulnerabilities

SQLite is a lightweight database that is an ACID compliant relational database management system. A security vulnerability exists in SQLite 3.40.0 and prior versions that stems from not properly implementing the azProhibitedFunctions protection mechanism when relying on --safe to execute untruste...

PT-2022-36807 · Git +1 · Libredwg

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 1 crash has been reported. The crash involves the functions bit read B, dwg decode header variables, and decode R13 RNUMBER. ...

Implementing Security Restrictions and Owner Access Controls on LPDA Smart Contract.

Lines of code Vulnerability details Vulnerability details Impact The new changes to the contract add an additional layer of security and restrict access to certain privileged functions. The buy function now requires that only the owner can purchase tokens, which prevents malicious actors from...

io.quarkus:quarkus-amazon-lambda-http (1.3.4.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.3.4.final) +53 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (1.3.4.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.3.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.3.4.final -...

io.quarkus:quarkus-amazon-lambda-http (1.9.0.cr1), io.quarkus:quarkus-amazon-lambda-http-deployment (1.9.0.cr1) +72 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (1.9.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 1.9.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.9.0.cr1 - io.quarkus:quarkus-amazon-lambda-http-deploymen...

io.quarkus:quarkus-amazon-lambda-http (1.1.0.cr1), io.quarkus:quarkus-amazon-lambda-http-deployment (1.1.0.cr1) +51 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (1.1.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 1.1.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.1.0.cr1 - io.quarkus:quarkus-amazon-lambda-http-deploymen...

io.quarkus:quarkus-amazon-lambda-http (1.11.4.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.11.4.final) +174 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (1.11.4.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.11.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.11.4.final -...