2528 matches found
CVE-2020-28482
This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: path: '/', sameSite: true 2. The CSRF token was available in the GET query parameter...
CVE-2021-21252
The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package "jquery-validation". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS Regular Expression Denial of Service. This is fixe...
Fedora 33 : flac (2021-df42ebeac2)
The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-df42ebeac2 advisory. - In FLACbitreaderreadricesignedblock of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remot...
CVE-2020-7784
This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-promises.js. The vulnerability is demonstrated with the following PoC:...
Design/Logic Flaw
This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-promises.js. The vulnerability is demonstrated with the following PoC:...
CVE-2020-28464
This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine...
CVE-2020-7771
The package asciitable.js before 1.0.3 are vulnerable to Prototype Pollution via the main function...
Fedora: Security Advisory for mbedtls (FEDORA-2020-e2d7a16ae9)
The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for gdm (EulerOS-SA-2020-2511)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for sox (EulerOS-SA-2020-2565)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Command injection
All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function...
CVE-2020-7791
CVE-2020-7791 affects the i18n package before 2.1.15. Root cause: insufficient handling of erroneous language tags in src/i18n/Concrete/TextLocalizer.cs and src/i18n/LocalizedApplication.cs. Impact: Denial of service ( DoS ), including a null pointer dereference per Veracode reference, with condi...
CVE-2020-7793
The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service ReDoS in multiple regexes see linked commit for more info...
PT-2020-17272 · Alt +3 · Alt Linux +2
Name of the Vulnerable Software and Affected Versions: ALT Linux affected versions not specified Description: The issue concerns a package vulnerability in ALT Linux. No specific details about the vulnerability, affected devices, or real-world incidents are provided. Recommendations: At the momen...
Input validation
This affects all versions of package react-adal. It is possible for a specially crafted JWT token and request URL can cause the nonce, session and refresh values to be incorrectly validated, causing the application to treat an attacker-generated JWT token as authentic. The logical defect is cause...
Code injection
Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF. An attacker can perform a large range of requests to ARIN reserved IP ranges, resulting in an indeterminable number of critical attack vectors, allowing remote...
Design/Logic Flaw
This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program...
CVE-2020-7772
This affects the package doc-path before 2.1.2...