Github regex 资源管理错误漏洞

Github regex is a Rust library for parsing, compiling, and executing regular expressions. A security vulnerability exists in regex that stems from a denial-of-service attack caused by an untrusted regex or untrusted input matched by a trusted regex...

CVE-2022-26336

A shortcoming in the HMEF package of poi-scratchpad Apache POI allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files Microsoft Outlook and Microsoft Exchange Server. If an application uses poi-scratchpad to parse TNEF files and the application allows...

PT-2022-17794 · Microsoft · Exchange Server +1

Name of the Vulnerable Software and Affected Versions: poi-scratchpad versions 5.2.0 and prior versions Description: A shortcoming in the HMEF package of poi-scratchpad allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files, which are associated with...

Ssr Pages Cross-Site Scripting Vulnerability

Ssr Pages is an Html page builder for Ssr server-side rendering. Ssr Pages suffers from a cross-site scripting vulnerability that can be exploited by an attacker to provide untrusted input to a redirect, resulting in cross-site scripting...

GHSA-7F63-H6G3-7CWM Cross Site Scripting (XSS) in @finastra/ssr-pages

A cross site scripting XSS issue can occur when providing untrusted input to the redirect.link property as an argument to the buildMessagePageOptions function. References - https://github.com/Finastra/ssr-pages/pull/2 -...

Path Traversal in @finastra/ssr-pages

A path traversal issue can occur when providing untrusted input to the svg property as an argument to the buildMessagePageOptions function. References - https://github.com/Finastra/ssr-pages/pull/1 - https://github.com/Finastra/ssr-pages/pull/1/commits/c3e4c563384ae3ba3892f37dd190218577620780...

Cross site scripting

ssr-pages is an HTML page builder for the purpose of server-side rendering SSR. In versions prior to 0.1.5, a cross site scripting XSS issue can occur when providing untrusted input to the redirect.link property as an argument to the buildMessagePageOptions function. While there is no known...

CVE-2022-24718 Path Traversal in ssr-pages

ssr-pages is an HTML page builder for the purpose of server-side rendering SSR. In versions prior to 0.1.4, a path traversal issue can occur when providing untrusted input to the svg property as an argument to the buildMessagePageOptions function. While there is no known workaround at this time,...

CVE-2022-24717 Cross Site Scripting (XSS) in ssr-pages

ssr-pages is an HTML page builder for the purpose of server-side rendering SSR. In versions prior to 0.1.5, a cross site scripting XSS issue can occur when providing untrusted input to the redirect.link property as an argument to the buildMessagePageOptions function. While there is no known...

SSR-pages 跨站脚本漏洞

Ssr Pages is an Html page builder for Ssr server-side rendering. Ssr Pages suffers from a cross-site scripting vulnerability that can be exploited by an attacker to provide untrusted input to a redirect, resulting in cross-site scripting...

ruby: HTTP response splitting in WEBrick

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients...

ruby: Code injection via command argument of Shell#test / Shell#[]

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument aka the "command" argument to Shell or Shelltest in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method...

UBUNTU-CVE-2022-23647

Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line plugin did not properly escape its output, leading to the input text being inserted int...

AlmaLinux 8 : python38:3.8 and python38-devel:3.8 (ALSA-2021:2583)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:2583 advisory. PyYAML: incomplete fix for CVE-2020-1747 CVE-2020-14343 Tenable has extracted the preceding description block directly from the AlmaLinux security advisory. Note...

Reolink RLC-410W TestEmail function out-of-bounds write vulnerability

Reolink Rlc-410W is a Wifi security camera from Reolink China.A security vulnerability exists in Reolink RLC-410W in version v3.0.0.13620121102, which stems from a boundary error in the TestEmail feature when handling untrusted input. An attacker could use a carefully constructed request to...

Expat integer overflow vulnerability

Expat is a fast streaming XML parser written in C. An integer overflow vulnerability exists in versions of Expat prior to 2.4.4, which stems from a boundary error when processing untrusted input and can be exploited by remote attackers to execute arbitrary code on the system...

Expat 输入验证错误漏洞

Expat is a fast streaming XML parser written in C. An integer overflow vulnerability exists in versions of Expat prior to 2.4.4, which stems from a boundary error when processing untrusted input and can be exploited by remote attackers to execute arbitrary code on the system...

Lexmark buffer overflow vulnerability

Lexmark is a series of printers in the U.S. Lexmark is vulnerable to a buffer overflow vulnerability that exists due to a boundary error when handling untrusted input. A remote attacker could exploit this vulnerability to execute arbitrary code on the system...

Moddable SDK 缓冲区错误漏洞

Moddable SDK is a software development kit SDK for IoT embedded software development from Moddable, U.S. Moddable SDK in v11.5.0 is vulnerable to a heap buffer overflow vulnerability stemming from a boundary error in component libcstartmain when handling untrusted input. A remote attacker could...

Moddable SDK 缓冲区错误漏洞

Moddable SDK is a set of software development kits SDKs for IoT embedded software development from the US company Moddable. The Moddable SDK has a stack buffer overflow vulnerability in v11.5.0 that stems from a boundary error in the component interceptorstrcat when handling untrusted input. A...