GHSA-PQHP-25J4-6HQ9 smol-toml has a Denial of Service via malicious TOML document using deeply nested inline tables

Summary An attacker can send a maliciously crafted TOML to cause the parser to crash because of a stack overflow caused by a deeply nested inline structure. A similar problem occurs when attempting to stringify deeply nested objects. The library does not limit the maximum exploration depth while...

PT-2024-40409 · Npm · Smol-Toml

Name of the Vulnerable Software and Affected Versions: smol-toml versions prior to 1.3.1 Description: The issue arises from the library's lack of limitation on the maximum exploration depth while parsing or producing TOML documents, allowing an attacker to cause a stack overflow by sending a...

Malicious code in xk6-toml (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 551700c0879f93238fce3b7ad7cdbad0c44f8e068838fb16e2078032e964835e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in xk6-toml

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2024-10280 Malicious code in xk6-toml (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 551700c0879f93238fce3b7ad7cdbad0c44f8e068838fb16e2078032e964835e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Oracle Linux 8 : python39:3.9 / and / python39-devel:3.9 (ELSA-2024-8359)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-8359 advisory. modwsgi numpy python39 3.9.20-1 - Update to 3.9.20 Resolves: RHEL-60007 python3x-pip python3x-setuptools python3x-six python-cffi python-chardet...

python39:3.9 and python39-devel:3.9 security update

modwsgi numpy python39 3.9.20-1 - Update to 3.9.20 Resolves: RHEL-60007 python3x-pip python3x-setuptools python3x-six python-cffi python-chardet python-cryptography python-idna python-lxml python-ply python-psutil python-psycopg2 python-pycparser python-PyMySQL python-pysocks python-requests...

CVE-2024-47180

Shields.io is a service for concise, consistent, and legible badges in SVG and raster format. Shields.io and users self-hosting their own instance of shields using version server-2024-09-25 are vulnerable to a remote execution vulnerability via the JSONPath library used by the Dynamic...

CVE-2024-47180 Shields.io Remote Code Execution vulnerability in Dynamic JSON/TOML/YAML badges

Shields.io is a service for concise, consistent, and legible badges in SVG and raster format. Shields.io and users self-hosting their own instance of shields using version server-2024-09-25 are vulnerable to a remote execution vulnerability via the JSONPath library used by the Dynamic...

PT-2024-32462 · Jsonpath +1 · Jsonpath +1

Name of the Vulnerable Software and Affected Versions: Shields.io versions prior to server-2024-09-25 Description: The issue concerns a remote execution vulnerability via the JSONPath library used by the Dynamic JSON/Toml/Yaml badges. This vulnerability allows any user with access to make a reque...

CVE-2024-47180: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Shields.io is a service for concise, consistent, and legible badges in SVG and raster format. Shields.io and users self-hosting their own instance of shields using version server-2024-09-25 are vulnerable to a remote execution vulnerability via the JSONPath library used by the Dynamic...

Oracle Linux 8 : python39:3.9 / and / python39-devel:3.9 (ELSA-2024-3466)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3466 advisory. - Security fixes for CVE-2023-6597 and CVE-2024-0450 Tenable has extracted the preceding description block directly from the Oracle Linux security...

Fedora: Security Advisory for ghc-toml-parser (FEDORA-2024-b458482d48)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 39 Update: ghc-toml-parser-1.3.2.0-29.fc39

TOML parser using generated lexers and parsers with careful attention to the TOML 1.0.0 semantics for defining tables...

Fedora 39 : ghc-base64 / ghc-hakyll / ghc-isocline / ghc-toml-parser / gitit / etc (2024-b458482d48)

The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-b458482d48 advisory. Security fix for CVE-2023-35936 and CVE-2023-38745 pandoc: - backport fixes for CVE-2023-35936 and CVE-2023-38745 pandoc-cli: - new package for pand...

[SECURITY] Fedora 40 Update: ghc-toml-parser-1.3.2.0-29.fc40

TOML parser using generated lexers and parsers with careful attention to the TOML 1.0.0 semantics for defining tables...

Fedora: Security Advisory for ghc-toml-parser (FEDORA-2024-7d83cbccb6)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

UBUNTU-CVE-2023-6159

An issue has been discovered in GitLab CE/EE affecting all versions from 12.7 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 It was possible for an attacker to trigger a Regular Expression Denial of Service via a Cargo.toml containing maliciously crafted input...

PT-2024-1477 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.7 through 16.6.5 GitLab CE/EE versions 16.7 through 16.7.3 GitLab CE/EE versions 16.8 through 16.8.0 Description: An issue has been discovered in GitLab CE/EE, where it is possible for an attacker to trigger a Regular...

failed imports

Lines of code Vulnerability details Impact Unable to comply correctly Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used manual and slither Recommended Mitigation Steps install...