2528 matches found
Design/Logic Flaw
This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require'three' function buildblank n var ret = "rgb" for var i = 0; i n; i++ ret += " " return ret + ""; var Color = three.Color var time = Date.now; new Colorbuildblank50000 var...
Debian: Security Advisory (DSA-4852-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2021-23335
All versions of package is-user-valid are vulnerable to LDAP Injection which can lead to either authentication bypass or information exposure...
CVE-2021-23335
CVE-2021-23335 affects the npm package is-user-valid (Node.js). The vulnerability is an LDAP Injection in the authentication logic, enabling potential authentication bypass or information exposure. The IBM bulletin confirms the CVE is acknowledged across IBM Cloud Pak for Data components (no expl...
Fedora 32 : 1:java-1.8.0-openjdk (2021-4cebc3aff9)
The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-4cebc3aff9 advisory. - New in release OpenJDK 8u282 2021-01-19 Live versions of these release notes can be found at: https://bitly.com/openjdk8u282...
Fedora 33 : 1:java-1.8.0-openjdk (2021-09272cf059)
The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-09272cf059 advisory. - New in release OpenJDK 8u282 2021-01-19 Live versions of these release notes can be found at: https://bitly.com/openjdk8u282...
Command injection
This affects all versions of package spritesheet-js. It depends on a vulnerable package platform-command. The injection point is located in line 32 in lib/generator.js, which is triggered by main entry of the package...
Code injection
This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...
Design/Logic Flaw
This affects all versions of package com.squareup:connect. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file...
Design/Logic Flaw
This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some case...
Command injection
All versions of package kill-process-on-port are vulnerable to Command Injection via a.getProcessPortId...
CentOS 8 : targetcli (CESA-2020:1933)
The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:1933 advisory. - targetcli: world writable /var/run/targetclid.sock allows unprivileged user to execute commands CVE-2020-10699 Note that Nessus has not tested for this issue...
CVE-2021-23329
The package nested-object-assign before 1.0.4 are vulnerable to Prototype Pollution via the default function, as demonstrated by running the PoC below...
Steam Socialite Provider v1 does not correctly validate openid server
Impact The outdated version 1 of the Steam Socialite Provider doesn't check properly if the login comes from steamcommunity.com, allowing a malicious actor to substitute their own openID server. Patches This vulnerability only affects the outdated v1.x versions of the package. These are no longer...
Design/Logic Flaw
This affects the package vis-timeline before 7.4.4. An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application...
EUVD-2021-0493
The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag...
CVE-2020-28483
This affects all versions of package github.com/gin-gonic/gin. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header...
CVE-2020-28452
This affects the package com.softwaremill.akka-http-session:core2.12 from 0 and before 0.6.1; all versions of package com.softwaremill.akka-http-session:core2.11; the package com.softwaremill.akka-http-session:core2.13 from 0 and before 0.6.1. CSRF protection can be bypassed by forging a request...
CVE-2020-28452 Cross-site Request Forgery (CSRF)
This affects the package com.softwaremill.akka-http-session:core2.12 from 0 and before 0.6.1; all versions of package com.softwaremill.akka-http-session:core2.11; the package com.softwaremill.akka-http-session:core2.13 from 0 and before 0.6.1. CSRF protection can be bypassed by forging a request...