Remote code execution

fis-parser-sass-bin a plugin for fis to compile sass using node-sass-binaries. fis-parser-sass-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker...

CVE-2016-10660

CVE-2016-10660 affects the fis-parser-sass-bin plugin used to compile Sass via node-sass-binaries. The vulnerability arises because the plugin downloads binary resources over HTTP, allowing a network-positioned attacker to perform a MITM interception and replace the requested binary with a malici...

CVE-2016-10686

CVE-2016-10686 affects the node wrapper fis-sass-all for libsass, where binary resources are downloaded over HTTP. The underlying issue enables a man-in-the-middle scenario: an attacker with network position can intercept the HTTP response and replace the requested executable with a malicious cop...

UBUNTU-CVE-2018-11695

An issue was discovered in LibSass 3.5.3. A NULL pointer dereference was found in the function Sass::Expand::operator which could be leveraged by an attacker to cause a denial of service application crash or possibly have unspecified other impact...

DEBIAN-CVE-2018-11696

An issue was discovered in LibSass through 3.5.4. A NULL pointer dereference was found in the function Sass::Inspect::operator which could be leveraged by an attacker to cause a denial of service application crash or possibly have unspecified other impact...

UBUNTU-CVE-2018-11693

An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::skipoverscopes which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service...

UBUNTU-CVE-2018-11696

An issue was discovered in LibSass through 3.5.4. A NULL pointer dereference was found in the function Sass::Inspect::operator which could be leveraged by an attacker to cause a denial of service application crash or possibly have unspecified other impact...

DEBIAN-CVE-2018-11695

An issue was discovered in LibSass 3.5.3. A NULL pointer dereference was found in the function Sass::Expand::operator which could be leveraged by an attacker to cause a denial of service application crash or possibly have unspecified other impact...

LibSaas Out-of-Bounds Read Vulnerability

LibSaas is a C/C++ implementation of the Sass compiler. An out-of-bounds read vulnerability exists in the Sass::handleerror function in LibSaas 3.5.4 and earlier. An attacker could use this vulnerability to obtain information or cause a denial of service...

LibSaas Null Pointer Dereference Vulnerability

LibSaas is a C/C++ implementation of the Sass compiler. A null pointer dereference vulnerability exists in the Sass::Inspect::operator function in LibSaas 3.5.4 and earlier. An attacker could exploit this vulnerability to cause a denial of service application crash or possibly other impact...

LibSaas null pointer dereference vulnerability (CNVD-2018-15182)

LibSaas is a C/C++ implementation of the Sass compiler. A null pointer dereference vulnerability exists in the Sass::Expand::operator function in LibSaas 3.5.2 and earlier. An attacker could exploit this vulnerability to cause a denial of service application crash or possibly other impact...

CVE-2016-10595

jdf-sass is a fork from node-sass, jdf use only. jdf-sass downloads executable resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested file with an attacker controlled file if the attacker is on the netwo...

CVE-2016-10595

jdf-sass is a fork from node-sass, jdf use only. jdf-sass downloads executable resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested file with an attacker controlled file if the attacker is on the netwo...

Remote code execution

jdf-sass is a fork from node-sass, jdf use only. jdf-sass downloads executable resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested file with an attacker controlled file if the attacker is on the netwo...

CVE-2016-10595

The CVE-2016-10595 issue affects the jdf-sass package, a fork of node-sass, which downloads resources over HTTP. The underlying root cause is unencrypted HTTP transfers allowing an attacker with a privileged network position to MITM the responses and swap in a malicious executable, potentially le...

CVE-2016-10595

jdf-sass is a fork from node-sass, jdf use only. jdf-sass downloads executable resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested file with an attacker controlled file if the attacker is on the netwo...

LibSass Memory Misreference Vulnerability

LibSass is an open source written in C using Sass CSS extension language parser . A memory misreference vulnerability exists in the 'handleerror' function in the sasscontext.cpp file in LibSass versions 3.4.x and 3.5.x through 3.5.4. An attacker could exploit this vulnerability to cause a denial ...

UBUNTU-CVE-2018-11499

A use-after-free vulnerability exists in handleerror in sasscontext.cpp in LibSass 3.4.x and 3.5.x through 3.5.4 that could be leveraged to cause a denial of service application crash or possibly unspecified other impact...

The vulnerability of the Sass::Eval::operator function (eval.cpp) in the LibSass library allows a hacker to cause a denial-of-service attack.

The vulnerability of the Sass::Eval::operator eval.cpp function in the LibSass library is caused by the consumption of memory resources on the stack. Exploiting this vulnerability may allow a malicious actor to cause a service failure...

LibSass Denial of Service Vulnerability

LibSass is an open source written in C using Sass CSS extension language parser . A denial of service vulnerability exists in the 'Sass::Eval::operator' function in the eval.cpp file in LibSass version 3.4.5. A remote attacker can exploit this vulnerability to cause a denial of service stack...