Mozilla: Ionmonkey type confusion with __proto__ mutations

Incorrect handling of proto mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write. This vulnerability affects Firefox 66.0.1, Firefox ESR 60.6.1, and Thunderbird 60.6.1...

UBUNTU-CVE-2019-9813

Incorrect handling of proto mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write. This vulnerability affects Firefox 66.0.1, Firefox ESR 60.6.1, and Thunderbird 60.6.1...

libpng-proto/png_transforms_fuzzer: Stack-use-after-return in OSS_FUZZ_png_safe_execute

Detailed report: https://oss-fuzz.com/testcase?key=5756860290826240 Project: libpng-proto Fuzzer: libFuzzerlibpng-protopngtransformsfuzzer Fuzz target binary: pngtransformsfuzzer Job Type: libfuzzerasanlibpng-proto Platform Id: linux Crash Type: Stack-use-after-return WRITE 8 Crash Address:...

actix (>=0.5.0, <=0.5.8), actix-ogn (0.1.0) +12 more potentially affected by CVE-2018-20994 via trust-dns-proto (>=0.2.0, <=0.3.3)

trust-dns-proto CARGO version =0.2.0, =0.5.0, =1.4.0, =0.2.0, =0.1.0, =0.11.0, =0.7.0, =0.2.2, =0.7.0, =0.8.2 - zicsv-tool 0.1.0 Source cves: CVE-2018-20994 Source advisory: OSV:RUSTSEC-2018-0007...

Denial of Service in protobufjs

Versions of protobufjs before 5.0.3 and 6.8.6 are vulnerable to a regular expression denial of service when parsing crafted invalid .proto files. Recommendation Update to version 5.0.3, 6.8.6 or later...

GHSA-762F-C2WG-M8C8 Denial of Service in protobufjs

Versions of protobufjs before 5.0.3 and 6.8.6 are vulnerable to a regular expression denial of service when parsing crafted invalid .proto files. Recommendation Update to version 5.0.3, 6.8.6 or later...

PBC Denial of Service Vulnerability (CNVD-2018-15646)

PBC is a Google protocol buffer library written in C. A denial of service vulnerability exists in the 'pbcPmessagedefault' function in the proto.c file of the libpbc.a static link library in PBC 2017-03-02 and earlier versions. An attacker can exploit this vulnerability to cause a denial of servi...

Protobufjs Denial of Service Vulnerability

protobufjs is a JavaScript implementation that can serialize structured data . A denial of service vulnerability exists in protobufjs. An attacker can exploit this vulnerability to cause a denial of service with an invalid specially crafted .proto file...

AZL-45420 CVE-2018-3721 affecting package js-jquery 3.5.0-4

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data MAID vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property tha...

CVE-2018-3738

protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files...

Code injection

protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files...

CVE-2018-3738

protobufjs is affected by a Denial of Service via a regular expression denial of service when parsing crafted invalid .proto files. Affected versions are prior to 5.0.3 and prior to 6.8.6. Remediation: upgrade to protobufjs 5.0.3 or later, or 6.8.6 or later. The issue arises from ReDoS during par...

CVE-2018-3738

protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files...

PT-2018-16161 · Protobufjs · Protobufjs

Name of the Vulnerable Software and Affected Versions: protobufjs versions prior to 5.0.3 protobufjs versions prior to 6.8.6 Description: The issue concerns a regular expression denial of service when parsing crafted invalid .proto files, potentially leading to ReDoS. Recommendations: Update to...

CVE-2018-3738: Allocation of Resources Without Limits or Throttling

protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files...

Cloud Foundry routing-release security bypass vulnerability

Cloud Foundry is a set of open source Platform-as-a-Service PaaS cloud computing platform from the Cloud Foundry Foundation in the United States, which provides container scheduling, continuous delivery, and automated service deployment. routing-release is one of the components that provides HTTP...

Man-in-the-Middle (MitM)

github.com/cloudfoundry/gorouter is vulnerable to man-in-the-middle MitM attacks. The vulnerability exists due to the lack of validation on the value of the X-Forwarded-Proto header, allowing the client to use a http connection and be prone to MitM attacks...

CVE-2018-1193

Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. A remote user can set the X-Forwarded-Proto header in a request to potentially bypass an application requirement to only respond over secure connections...

Authentication flaw

Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. A remote user can set the X-Forwarded-Proto header in a request to potentially bypass an application requirement to only respond over secure connections...

CVE-2018-1193

Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. A remote user can set the X-Forwarded-Proto header in a request to potentially bypass an application requirement to only respond over secure connections...