domain-suffix 安全漏洞

domain-suffix is a Node.js package. A security vulnerability exists in domain-suffix version 1.0.8, which stems from a vulnerability that allows an attacker to crash an application using crafted input via the parse function...

CVE-2024-25354

RegEx Denial of Service in domain-suffix 1.0.8 allows attackers to crash the application via crafted input to the parse function...

PT-2024-40680 · Git +1 · Quickjs

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 1 crash has been reported. The crash state includes functions such as emit goto, emit class field init, and js parse function...

PT-2024-20898 · Unknown · Domain-Suffix

Name of the Vulnerable Software and Affected Versions: domain-suffix version 1.0.8 Description: The issue allows attackers to crash the application via crafted input to the parse function, resulting in a Denial of Service. This is achieved through a RegEx Denial of Service in the domain-suffix...

CVE-2024-25354

The domain-suffix Node.js package (version 1.0.8 ) is vulnerable to a RegEx Denial of Service (ReDoS) . An attacker can crash the application by providing crafted input to the parse function, which triggers excessive backtracking in the regular expression engine. A proof-of-concept (PoC) demonstr...

CVE-2024-25354: Undefined Security Weakness

RegEx Denial of Service in domain-suffix 1.0.8 allows attackers to crash the application via crafted input to the parse function...

Improper Validation of Syntactic Correctness of Input

Overview Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input in the phonenumbers.Parse function. An attacker can cause a panic by providing crafted input causing a "runtime error: slice bounds out of range". PoC go import "fmt"...

Vulnerability of the bfd_pef_parse_function_stubs function in the GNU Binutils development environment, caused by buffer overflow in dynamic memory, allowing an attacker to trigger a stack overflow.

The vulnerability of the bfdpefparsefunctionstubs function in the GNU Binutils development toolset, located in the bfd/pef.c file, is caused by a buffer overflow in the dynamic memory. Exploiting this vulnerability could allow an attacker to trigger a stack overflow...

SUSE CVE-2023-38851

Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the xlsparseWorkBook function in xls.c:1018...

CVE-2023-40294

libboron in Boron 2.0.8 has a heap-based buffer overflow in urparseBlockI at iparseblk.c...

Denial Of Service (DoS)

github.com/malfunkt/iprange is vulnerable to Denial of Service DoS attacks. The vulnerability exists in Parse function of y.go, which allows a malicious user to parse a range with a mask larger than 32 bits which causes a panic, resulting in an application crash...

SUSE CVE-2023-36665

"protobuf.js aka protobufjs 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions...

GHSA-H755-8QP9-CQ85 protobufjs Prototype Pollution vulnerability

protobuf.js aka protobufjs 6.10.0 until 6.11.4 and 7.0.0 until 7.2.4 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and...

CVE-2023-36665

"protobuf.js aka protobufjs 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions...

CVE-2023-36665

"protobuf.js aka protobufjs 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions...

ALPINE-CVE-2023-33460

There's a memory leak in yajl 2.1.0 with use of yajltreeparse function. which will cause out-of-memory in server and cause crash...

PT-2023-23518

Name of the Vulnerable Software and Affected Versions Jerryscript version 3.0 commit 1a2c047 Description An Assertion Failure was discovered in Jerryscript via the parser parse function arguments at jerry-core/parser/js/js-parser.c. Recommendations For Jerryscript version 3.0 commit 1a2c047,...

CVE-2023-31910

Removed by vendor...

JerryScript 缓冲区错误漏洞

JerryScript is a lightweight JavaScript engine from the Jerryscript project. A security vulnerability exists in JerryScript version 3.0.0 1a2c047, which originates in the component parserparsefunctionstatement in /jerry-core/parser/js/js-parser-statm.c contains a heap buffer overflow...

PT-2023-23514

Name of the Vulnerable Software and Affected Versions Jerryscript version 3.0 commit 05dbbd1 Description A heap-buffer-overflow issue was discovered in the parser parse function statement component at /jerry-core/parser/js/js-parser-statm.c. This issue affects the parsing of function statements...