Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection in the CSS-to-JavaScript module conversion feature. An attacker can execute arbitrary JavaScript code by injecting $... expressions into CSS files, which are then evaluated when the resulting JavaScript module i...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection in the CLI, via the -c/--cmd option. The processing of commandline options in src/bin.mts calls the foregroundChild on them, which defaults to setting shell: true. An attacker who can control the filenames being matche...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the openEditor function when the EDITOR environment variable and configuration file path that are passed unsanitized to a shell command. An attacker can execute arbitrary system commands by manipulating the EDITOR...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the endpoint parameter in Headless API. An attacker can perform unauthorized actions by tricking a user into making unintended requests. Remediation A fix was pushed into the master branch but not yet...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack via discrepancies in processing invalid padding errors in legacy API mbedtlsciphercrypt and mbedtlscipherfinish functions and in the PSA Crypto API psacipherdecrypt and psacipherfinish functions when handling any other...

Arbitrary Code Injection

Overview @cocalc/frontend is a CoCalc: Collaborative Calculation Affected versions of this package are vulnerable to Arbitrary Code Injection via uploading a crafted SVG file. An attacker can execute arbitrary code by uploading a specially crafted SVG file. Remediation A fix was pushed into the...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the jstypedarrayindexOf function when a negative floating-point fromIndex argument with extremely small magnitude is supplied. An attacker can access memory beyond the end of a typed array by providing a crafted...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the jsbigintfromstring function when parsing strings with an excessively large number of digits. An attacker can cause a heap out-of-bounds write by supplying a crafted string input that triggers an...

Symlink Attack

Overview Microsoft.Build.Tasks.Core is a This package contains the Microsoft.Build.Tasks assembly which implements the commonly used tasks of MSBuild. Affected versions of this package are vulnerable to Symlink Attack via improper handling of symbolic links before file access. An attacker can gai...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via improper handling of symbolic links before file access. An attacker can gain elevated privileges by exploiting the way the system resolves links, potentially accessing or modifying files with higher permissions...

Incorrect Execution-Assigned Permissions

Overview Affected versions of this package are vulnerable to Incorrect Execution-Assigned Permissions via the process responsible for executing system commands. An attacker can execute arbitrary commands on the server by sending crafted requests after authentication. Remediation A fix was pushed...

GHSA-M2VG-RMQ6-P62R Opencast's Paella Player 7 is vulnerable to Cross-Site Scripting

Prior to Opencast 17.8 and 18.2 the paella would include and render some user inputs metadata like title, description, etc. unfiltered and unmodified. Impact The vulnerability allows attackers to inject and malicious HTML and JavaScript in the player, which would then be executed in the browsers ...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the bfdelfgcrecordvtentry function. An attacker can cause a denial of service by providing specially crafted input files that trigger an out-of-bounds read during the linking process. Remediation A fix was pushed...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the elflinkaddobjectsymbols function in the Linker component. An attacker can cause a crash by supplying specially crafted input files during local processing. Remediation A fix was pushed into the master branch b...

Interpretation Conflict

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict due to improper handling of quoted local-parts containing @. An attacker can cause emails to be sent to unintended...

Improper Handling of Invalid Use of Special Elements

Overview Affected versions of this package are vulnerable to Improper Handling of Invalid Use of Special Elements via the handling of usernames. An attacker can inject shell expressions into command-line constructor by supplying usernames containing control characters. This is only exploitable if...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the resolvecontentpath process. An attacker can cause a write operation to occur one byte past the end of a heap-allocated buffer by crafting a specially designed MPEG-DASH manifest that triggers the appending of ...

Improper Neutralization of Null Byte or NUL Character

Overview Affected versions of this package are vulnerable to Improper Neutralization of Null Byte or NUL Character due to improper handling of unexpected conditions in the function mghandleformrequest. An attacker can cause the application to become unresponsive or crash by sending specially...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the dumpdwarfsection function. An attacker can cause a denial of service by providing specially crafted input that triggers an out-of-bounds read during processing. Remediation A fix was pushed into the master...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference via the fromJson function. An attacker can cause a denial of service by providing a crafted argument to trigger a null pointer dereference. Remediation Upgrade behaviortree.cpp to version 4.9.0 or higher...