LibSaas null pointer dereference vulnerability (CNVD-2018-15182)

LibSaas is a C/C++ implementation of the Sass compiler. A null pointer dereference vulnerability exists in the Sass::Expand::operator function in LibSaas 3.5.2 and earlier. An attacker could exploit this vulnerability to cause a denial of service application crash or possibly other impact...

LibSaas Out-of-Bounds Read Vulnerability

LibSaas is a C/C++ implementation of the Sass compiler. An out-of-bounds read vulnerability exists in the Sass::handleerror function in LibSaas 3.5.4 and earlier. An attacker could use this vulnerability to obtain information or cause a denial of service...

PT-2018-10758

Name of the Vulnerable Software and Affected Versions LibSass versions prior to 3.5.5 Description An issue was discovered in LibSass where an out-of-bounds read of a memory region was found in the function Sass::handle error. This could be leveraged by an attacker to disclose information or...

PT-2018-10756

Name of the Vulnerable Software and Affected Versions LibSass versions prior to 3.5.5 Description A NULL pointer dereference was found in the function Sass::Inspect::operator, which could be leveraged by an attacker to cause a denial of service application crash or possibly have unspecified other...

PT-2018-10755

Name of the Vulnerable Software and Affected Versions LibSass versions prior to 3.5.3 Description A NULL pointer dereference was found in the Sass::Expand::operator function, which could be leveraged by an attacker to cause a denial of service application crash or possibly have unspecified other...

PT-2018-10754

Name of the Vulnerable Software and Affected Versions LibSass versions prior to 3.5.5 Description A NULL pointer dereference was found in the Sass::Functions::selector append function, which could be leveraged by an attacker to cause a denial of service application crash or possibly have...

PT-2018-10753

Name of the Vulnerable Software and Affected Versions LibSass versions prior to 3.5.5 Description An issue was discovered in the function Sass::Prelexer::skip over scopes, which could allow an attacker to disclose information or cause a denial of service due to an out-of-bounds read of a memory...

PT-2018-4838

Name of the Vulnerable Software and Affected Versions fis-parser-sass-bin affected versions not specified Description The issue arises from fis-parser-sass-bin downloading binary resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. This could potentially lead to remote co...

PT-2018-6068

Name of the Vulnerable Software and Affected Versions: gfe-sass versions affected versions not specified Description: The gfe-sass library downloads resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. This could potentially lead to remote code execution RCE if an attacke...

CVE-2016-10686: Missing Encryption of Sensitive Data

fis-sass-all is another libsass wrapper for node. fis-sass-all downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on the...

CVE-2017-16040: Missing Encryption of Sensitive Data

gfe-sass is a library for promises CommonJS/Promises/A,B,D gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on the...

CVE-2018-11698: Out-of-bounds Read

An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::handleerror which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service...

CVE-2018-11697: Out-of-bounds Read

An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::exactly which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service...

CVE-2018-11695: NULL Pointer Dereference

An issue was discovered in LibSass 3.5.3. A NULL pointer dereference was found in the function Sass::Expand::operator which could be leveraged by an attacker to cause a denial of service application crash or possibly have unspecified other impact...

PT-2018-4864

Name of the Vulnerable Software and Affected Versions fis-sass-all affected versions not specified Description The issue concerns the insecure download of binary resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. This could potentially lead to remote code execution RCE ...

Remote code execution

jdf-sass is a fork from node-sass, jdf use only. jdf-sass downloads executable resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested file with an attacker controlled file if the attacker is on the netwo...

CVE-2016-10595

jdf-sass is a fork from node-sass, jdf use only. jdf-sass downloads executable resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested file with an attacker controlled file if the attacker is on the netwo...

CVE-2016-10595

jdf-sass is a fork from node-sass, jdf use only. jdf-sass downloads executable resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested file with an attacker controlled file if the attacker is on the netwo...

CVE-2016-10595

The CVE-2016-10595 issue affects the jdf-sass package, a fork of node-sass, which downloads resources over HTTP. The underlying root cause is unencrypted HTTP transfers allowing an attacker with a privileged network position to MITM the responses and swap in a malicious executable, potentially le...

CVE-2016-10595

jdf-sass is a fork from node-sass, jdf use only. jdf-sass downloads executable resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested file with an attacker controlled file if the attacker is on the netwo...