833 matches found
fio:fuzz_parseini: Heap-use-after-free in sort_options
Detailed Report: https://oss-fuzz.com/testcase?key=5965431360323584 Project: fio Fuzzing Engine: afl Fuzz Target: fuzzparseini Job Type: aflasanfio Platform Id: linux Crash Type: Heap-use-after-free WRITE 8 Crash Address: 0x606000000200 Crash State: sortoptions fiooptionsparse parsejobsini...
Oracle Linux 8 : nodejs:16 (ELSA-2021-5171)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-5171 advisory. - Resolves CVE-2020-28469 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has...
RLSA-2021:5171 Moderate: nodejs:16 security, bug fix, and enhancement update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 16.13.1, nodejs-nodemon 2.0.15. BZ2027610 Security Fixes: nodejs-json-schema:...
fio:fuzz_parseini: Crash in log_err
Detailed Report: https://oss-fuzz.com/testcase?key=5300548857888768 Project: fio Fuzzing Engine: libFuzzer Fuzz Target: fuzzparseini Job Type: libfuzzerubsanfio Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000500000004 Crash State: logerr fiooptionsparse parsejobsini Sanitizer:...
Whispers - Identify Hardcoded Secrets In Static Structured Text
"My little birds are everywhere, even in the North, they whisper to me the strangest stories." - Lord Varys Whispers is a static code analysis tool designed for parsing various common data formats in search of hardcoded credentials and dangerous functions. Whispers can run in the CLI or you can...
GHSA-RRC9-GQF8-8RWG Prototype Pollution via file load in aws-sdk and @aws-sdk/shared-ini-file-loader
This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited furth...
fio:fuzz_parseini: Crash with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=6236771218751488 Project: fio Fuzzing Engine: libFuzzer Fuzz Target: fuzzparseini Job Type: libfuzzerubsanfio Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00ad9e1702a0 Crash State: NULL Sanitizer: undefined UBSAN Recommended...
nodejs-ini: Prototype pollution via malicious INI file
A flaw was found in nodejs-ini. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context...
RHEL 7 : rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon (RHSA-2021:3281)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3281 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...
fio:fuzz_parseini: Crash with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=5127635201032192 Project: fio Fuzzing Engine: libFuzzer Fuzz Target: fuzzparseini Job Type: libfuzzerubsanfio Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7f36a304acf0 Crash State: NULL Sanitizer: undefined UBSAN Recommended...
MetInfo File Modification Vulnerability
MetInfo adopts PHP+Mysql architecture, it is a cms building system which is very friendly to SEO, fully functional, supports multi-language, responsive display, and extremely suitable for enterprise and company website construction. A file modification vulnerability exists in MetInfo 7.0 beta. An...
fio:fuzz_parseini: Segv on unknown address in add_file
Detailed Report: https://oss-fuzz.com/testcase?key=5887397356240896 Project: fio Fuzzing Engine: afl Fuzz Target: fuzzparseini Job Type: aflasanfio Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: addfile strfilenamecb handleoption Sanitizer: address ASAN Crash...
CVE-2020-20907
MetInfo 7.0 beta is affected by a file modification vulnerability. Attackers can delete and modify ini files in app/system/language/admin/languagegeneral.class.php and app/system/include/function/file.func.php...
CVE-2020-20907
MetInfo 7.0 beta is affected by a file modification vulnerability. Attackers can delete and modify ini files in app/system/language/admin/languagegeneral.class.php and app/system/include/function/file.func.php...
Design/Logic Flaw
MetInfo 7.0 beta is affected by a file modification vulnerability. Attackers can delete and modify ini files in app/system/language/admin/languagegeneral.class.php and app/system/include/function/file.func.php...
CVE-2020-20907
MetInfo 7.0 beta is affected by a file modification vulnerability. Attackers can delete and modify ini files in app/system/language/admin/languagegeneral.class.php and app/system/include/function/file.func.php...
CVE-2021-24307
The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseotoolssettings" privilege most of the time admin to execute arbitrary code on the underlying host. Users can restore plugin's configuration by uploading a backup...
PT-2021-15844
Name of the Vulnerable Software and Affected Versions The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings versions prior to 4.1.0.2 Description The issue allows authenticated users with aioseo tools settings privilege, typically admins, to execute arbitrary code on t...
Prototype Pollution in multi-ini
This affects the package multi-ini before 2.1.1. It is possible to pollute an object's prototype by specifying the proto object as part of an array...