4246 matches found
CVE-2020-23369
CVE-2020-23369 affects YzmCMS 5.6, where a cross-site scripting vulnerability exists in member/member_content/init.html due to using UEditor 1.4.3.3 . The underlying issue is an XSS via the SRC attribute of an IFRAME element, allowing injected scripts. Public records in NVD/CNVD/CNNVD confirm the...
PT-2021-10890
Name of the Vulnerable Software and Affected Versions YzmCMS version 5.6 Description A cross-site scripting XSS issue was found in the member/member content/init.html file due to the use of UEditor 1.4.3.3, specifically via the SRC attribute of an IFRAME element. Recommendations For YzmCMS versio...
CVE-2020-23369: Improper Neutralization of Input During Web Page Generation
In YzmCMS 5.6, XSS was discovered in member/membercontent/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3...
GHSA-G4HJ-R7R3-9RWV OS Command Injection in gulp-scss-lint
gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...
WS-2021-0138
Fluent Bit in versions 1.3.0 to 1.7.4 is vulnerable to Stack-buffer-overflow in flbsdscat, related to src/flbrecordaccessor.c...
PT-2021-16800
Name of the Vulnerable Software and Affected Versions MERCUSYS Mercury X18G version 1.0.5 Description A Cross Site Scripting XSS issue exists, allowing exploitation through crafted values to the src dport start, src dport end, and dest port parameters. Recommendations For MERCUSYS Mercury X18G...
CVE-2021-28855
In Deark before 1.5.8, a specially crafted input file can cause a NULL pointer dereference in the dbufwrite function src/deark-dbuf.c...
CVE-2021-28856
In Deark before v1.5.8, a specially crafted input file can cause a division by zero in src/fmtutil.c because of the value of pixelsize...
CVE-2021-28855: NULL Pointer Dereference
In Deark before 1.5.8, a specially crafted input file can cause a NULL pointer dereference in the dbufwrite function src/deark-dbuf.c...
CVE-2021-28856: Divide By Zero
In Deark before v1.5.8, a specially crafted input file can cause a division by zero in src/fmtutil.c because of the value of pixelsize...
CVE-2021-20235
There's a flaw in the zeromq server in versions before 4.3.3 in src/decoderallocators.hpp. The decoder static allocator could have its sized changed, but the buffer would remain the same as it is a static buffer. A remote, unauthenticated attacker who sends a crafted request to the zeromq server...
CVE-2021-20234
An uncontrolled resource consumption memory leak flaw was found in the ZeroMQ client in versions before 4.3.3 in src/pipe.cpp. This issue causes a client that connects to multiple malicious or compromised servers to crash. The highest threat from this vulnerability is to system availability...
CVE-2021-20235: Buffer Copy without Checking Size of Input
There's a flaw in the zeromq server in versions before 4.3.3 in src/decoderallocators.hpp. The decoder static allocator could have its sized changed, but the buffer would remain the same as it is a static buffer. A remote, unauthenticated attacker who sends a crafted request to the zeromq server...
CVE-2021-20234: Uncontrolled Resource Consumption
An uncontrolled resource consumption memory leak flaw was found in the ZeroMQ client in versions before 4.3.3 in src/pipe.cpp. This issue causes a client that connects to multiple malicious or compromised servers to crash. The highest threat from this vulnerability is to system availability...
CVE-2021-20193
A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability...
CVE-2021-20193
A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability...
CVE-2021-20193: Missing Release of Memory after Effective Lifetime
A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability...
CVE-2021-20227
A flaw was found in SQLite's SELECT query functionality src/select.c. This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerabilit...
CVE-2021-20227: Use After Free
A flaw was found in SQLite's SELECT query functionality src/select.c. This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerabilit...