CVE-2021-20193

A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability...

CVE-2021-20193: Missing Release of Memory after Effective Lifetime

A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability...

CVE-2021-20227

A flaw was found in SQLite's SELECT query functionality src/select.c. This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerabilit...

CVE-2021-20227: Use After Free

A flaw was found in SQLite's SELECT query functionality src/select.c. This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerabilit...

WS-2021-0146

SELinux userspace is vulnerable toHeap-use-after-free , related to libsepol/cil/src/cilresetast.c...

WS-2021-0075

LibreDWG in versions 0.12.3.4163 to 0.12.3.4191, is vulnerable to double-free in hdldat at src/encode.c...

CVE-2021-23345

All versions of package github.com/thecodingmachine/gotenberg are vulnerable to Server-side Request Forgery SSRF via the /convert/html endpoint when the src attribute of an HTML element refers to an internal system file, such as...

CVE-2021-23345: Server-Side Request Forgery (SSRF)

All versions of package github.com/thecodingmachine/gotenberg are vulnerable to Server-side Request Forgery SSRF via the /convert/html endpoint when the src attribute of an HTML element refers to an internal system file, such as...

PT-2021-15449

Name of the Vulnerable Software and Affected Versions github.com/thecodingmachine/gotenberg affected versions not specified Description The issue allows for Server-side Request Forgery SSRF via the "/convert/html" endpoint. This occurs when the src attribute of an HTML element, such as an iframe,...

WS-2021-0139

in WABT through 1.0.23, there is global-buffer-overflow in wabt::GetRelocTypeName, related to src/common.h...

CVE-2021-26541

The gitlog function in src/index.ts in gitlog before 4.0.4 has a command injection vulnerability...

Command injection

The gitlog function in src/index.ts in gitlog before 4.0.4 has a command injection vulnerability...

CVE-2021-26541

The gitlog function in src/index.ts in gitlog before 4.0.4 has a command injection vulnerability...

EUVD-2021-0771

The gitlog function in src/index.ts in gitlog before 4.0.4 has a command injection vulnerability...

CVE-2021-26541

The gitlog function in src/index.ts in gitlog before 4.0.4 has a command injection vulnerability...

CVE-2021-26540

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts...

Ron-checkmarx gitlog command injection vulnerability

Ron-checkmarx gitlog is a parser from the US-based Ron-checkmarx organization. It provides a Git log parser for Node.JS. A command injection vulnerability exists in gitlog version 4.0.4, which stems from the gitlog function in src/index not properly filtering special elements within it. An attack...

PT-2021-17028

Name of the Vulnerable Software and Affected Versions gitlog versions prior to 4.0.4 Description The issue is related to a command injection vulnerability in the gitlog function, located in src/index.ts. This vulnerability can be exploited due to insufficient input validation, allowing an attacke...

CVE-2021-26541: Improper Neutralization of Special Elements used in an OS Command

The gitlog function in src/index.ts in gitlog before 4.0.4 has a command injection vulnerability...

GHSA-VV2X-VRPJ-QQPQ Cross-site scripting in Bleach

Impact A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument stripcomments=False Note: none of the above tags are in the default...