CVE-2021-38586

In cPanel before 98.0.1, /scripts/cpanconfig performs unsafe operations on files SEC-589...

rust: heap-based buffer overflow in read_to_end() because it does not validate the return value from Read in an unsafe context

In the standard library in Rust before 1.50.0, readtoend does not validate the return value from Read in an unsafe context. This bug could lead to a buffer overflow...

rust: heap-based buffer overflow in read_to_end() because it does not validate the return value from Read in an unsafe context

In the standard library in Rust before 1.50.0, readtoend does not validate the return value from Read in an unsafe context. This bug could lead to a buffer overflow...

PYSEC-2021-119

23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each li...

CVE-2021-38188

An issue was discovered in the iced-x86 crate through 1.10.3 for Rust. In Decoder::new, slice.getuncheckedslice.length is used unsafely...

Code injection

An issue was discovered in the iced-x86 crate through 1.10.3 for Rust. In Decoder::new, slice.getuncheckedslice.length is used unsafely...

CVE-2021-38188

The CVE-2021-38188 issue concerns the iced-x86 crate (Rust) up to version 1.10.3. The root cause is unsafe use of slice.get_unchecked(slice.length()) in Decoder::new(), which can lead to undefined behavior and potential security impact as described by multiple advisories. Public details consisten...

CVE-2021-38188

An issue was discovered in the iced-x86 crate through 1.10.3 for Rust. In Decoder::new, slice.getuncheckedslice.length is used unsafely...

CVE-2021-37550

In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used...

CVE-2021-37550

In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used...

Design/Logic Flaw

In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used...

CVE-2021-37550

In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used...

CVE-2021-37550

CVE-2021-37550 concerns JetBrains YouTrack. The vulnerability arises from time-unsafe comparisons in YouTrack prior to version 2021.2.16363 (JT-63697). The issue affects YouTrack and is addressed by the fix in 2021.2.16363, as noted in JetBrains Security Bulletin Q2 2021. The available documents ...

CVE-2021-37550

In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used...

CVE-2021-22925

curl supports the -t command line option, known as CURLOPTTELNETOPTIONSin libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending NEWENV variables, libcurlcould be made to pass on uninitialized data from a stack based...

CVE-2021-21863

A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2021-21863

A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2021-21863

The TALOS report documents a deserialization vulnerability in CODESYS Development System 3.5.16–3.5.17. The flaw is in ComponentModel.Profile.FromFile(), which deserializes a profile via BinaryFormatter.Deserialize, a known unsafe pattern for untrusted input. This can lead to arbitrary code execu...

CVE-2021-21863

A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability...

Prototype Pollution

Overview open-graph is an Open Graph implementation for Node.js. Affected versions of this package are vulnerable to Prototype Pollution. The function parse could be tricked into adding or modifying properties of Object.prototype using a proto or constructor payload. PoC by Snyk // server.js cons...