184 matches found
GHSA-XFG5-VRMC-24WC Obsidian Dataview vulnerable to code injection due to unsafe eval
Obsidian Dataview through 0.4.12-hotfix1 allows eval injection. The evalInContext function in executes user input, which allows an attacker to craft malicious Markdown files that will execute arbitrary code once opened. NOTE: 0.4.13 provides a mitigation for some use cases...
GHSA-5FH8-X9XC-HXMC irisnet-crypto RCE Vulnerability
In irisnet-crypto before 1.1.7 for IRISnet, the util/utils.js file allows code execution because of unsafe eval usage...
CLSA-2022-1646085619 Fix of CVE: CVE-2020-27619, CVE-2021-23336
CVE-2020-27619: Unsafe use of eval on data retrieved via HTTP in the test suite rhbz1889886 - CVE-2021-23336: Web cache poisoning via urllib.parse.parseqsl and urllib.parse.parseqs by using a semicolon in query parameters rhbz1928904...
CVE-2021-3725
Vulnerability in dirhistory plugin Description: the widgets that go back and forward in the directory history, triggered by pressing Alt-Left and Alt-Right, use functions that unsafely execute eval on directory names. If you cd into a directory with a carefully-crafted name, then press Alt-Left,...
ohmyzsh 代码注入漏洞
ohmyzsh is an open source, community-driven framework for managing your zsh configuration. ohmyzsh suffers from an operating system command injection vulnerability that stems from a widget that moves back and forth in the directory history triggered by pressing Alt-Left and Alt-Right using a...
RHEL 8 : python38:3.8 and python38-devel:3.8 (RHSA-2021:4162)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4162 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...
CentOS 8 : python38:3.8 and python38-devel:3.8 (CESA-2021:4162)
The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4162 advisory. - python-psutil: Double free because of refcount mishandling CVE-2019-18874 - python: Unsafe use of eval on data retrieved via HTTP in the test suite...
python: Unsafe use of eval() on data retrieved via HTTP in the test suite
In Python3's Lib/test/multibytecodecsupport.py CJK codec tests call eval on content retrieved via HTTP...
CLSA-2021-1633442879 Fix of CVE: CVE-2020-26116, CVE-2020-8492, CVE-2018-20852, CVE-2020-27619
Add Oracle Linux distribution in platform.py - CVE-2018-20852: Prefix dot in domain for proper subdomain validation - CVE-2020-8492: Python allows an HTTP server to conduct Regular Expression Denial of Service ReDoS attacks against a client - CVE-2020-26116: http.client allows CRLF injection if...
python: Unsafe use of eval() on data retrieved via HTTP in the test suite
In Python3's Lib/test/multibytecodecsupport.py CJK codec tests call eval on content retrieved via HTTP...
python: Unsafe use of eval() on data retrieved via HTTP in the test suite
In Python3's Lib/test/multibytecodecsupport.py CJK codec tests call eval on content retrieved via HTTP...
RHEL 8 : python3 (RHSA-2021:1633)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1633 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...
CentOS 8 : python3 (CESA-2021:1633)
The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1633 advisory. - python: CRLF injection via HTTP request method in httplib/http.client CVE-2020-26116 - python: Unsafe use of eval on data retrieved via HTTP in the...
python: Unsafe use of eval() on data retrieved via HTTP in the test suite
In Python3's Lib/test/multibytecodecsupport.py CJK codec tests call eval on content retrieved via HTTP...
GHSA-CWCP-6C48-FM7M Unsafe eval() in summit allows arbitrary code execution
Affected versions of summit allow attackers to execute arbitrary commands via collection names when using the PouchDB driver. Recommendation No direct patch is available at this time. Currently, the best option to mitigate the issue is to avoid using the PouchDB driver, as the package author has...
Code injection
In irisnet-crypto before 1.1.7 for IRISnet, the util/utils.js file allows code execution because of unsafe eval usage...
CVE-2019-9115
In irisnet-crypto before 1.1.7 for IRISnet, the util/utils.js file allows code execution because of unsafe eval usage...
CVE-2019-9115
In irisnet-crypto before 1.1.7 for IRISnet, the util/utils.js file allows code execution because of unsafe eval usage...
CVE-2019-9115
irisnet-crypto before 1.1.7 for IRISnet contains unsafe eval usage in util/utils.js, enabling remote code execution (RCE). This is confirmed by multiple sources (GHSA-5FH8-X9XC-HXMC, OSV) and aligns with CVE-2019-9115 severity (NVD: high/critical). Mitigation: upgrade to version 1.1.7 or later; n...
