GHSA-9X4H-8WGM-8XFG Malformed CAR panics and excessive memory usage

Impact Versions impacted = [email protected] = [email protected] Description of user-facing changes...

CVE-2022-32533

Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no...

Apache Jetspeed-2 安全漏洞

Apache Jetspeed-2 is a very open and customizable portal platform from the Apache USA Foundation. Apache Jetspeed-2 suffers from an input validation error vulnerability that stems from Apache Jetspeed-2 failing to adequately filter untrusted user input by default, which can be exploited by an...

Insufficiently complex hash function used in `useFetch` means return data cannot be trusted

Description The useFetch function uses the ohash library to key requests. This hash function outputs a 32 bit number. Finding a collision for this function is easy. In a situation where useFetch is called more than once, any call after the first that contains untrusted input into any argument is...

UBUNTU-CVE-2022-2309

NULL Pointer Dereference allows attackers to cause a denial of service or application crash. This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code...

PYSEC-2022-230

NULL Pointer Dereference allows attackers to cause a denial of service or application crash. This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code...

CVE-2022-2309

NULL Pointer Dereference allows attackers to cause a denial of service or application crash. This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code...

PYSEC-2022-230

NULL Pointer Dereference allows attackers to cause a denial of service or application crash. This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code...

CVE-2022-2309

NULL Pointer Dereference allows attackers to cause a denial of service or application crash. This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code...

Vim suggest_trie_walk function buffer overflow vulnerability

Vim is a cross-platform text editor. A buffer overflow vulnerability exists in versions prior to Vim 9.0 that stems from a boundary error in the suggesttriewalk function when handling untrusted input. An attacker can exploit the vulnerability to cause a software crash, memory modification, and...

HUAWEI HarmonyOS 安全漏洞

HUAWEI HarmonyOS is an operating system from Huawei, China HUAWEI. It provides a microkernel-based, full-scenario distributed operating system. HUAWEI HarmonyOS is vulnerable to a buffer overflow vulnerability. The vulnerability stems from a boundary error when handling untrusted input. An attack...

PT-2022-7707 · Lxml +10 · Lxml +10

Name of the Vulnerable Software and Affected Versions: lxml versions 2.9.10 through 2.9.14 Description: The issue allows attackers to cause a denial of service or application crash when lxml is used together with libxml2. It is triggered by forged input data and a vulnerable code sequence in the...

Vim inc function buffer overflow vulnerability

Vim is a cross-platform text editor. versions prior to Vim 9.0.0011 are vulnerable to a buffer overflow vulnerability that stems from a boundary error in the inc function when handling untrusted input. A remote attacker could exploit this vulnerability to crash the software, modify memory, and...

Vim 缓冲区错误漏洞

Vim is a cross-platform text editor. buffer overflow vulnerability exists in versions of Vim prior to 9.0, which stems from a boundary error in parsecommandmodifiers when handling untrusted input. A remote attacker could exploit this vulnerability to cause data corruption, crash, or code executio...

CVE-2022-34913

md2roff 1.7 has a stack-based buffer overflow via a Markdown file containing a large number of consecutive characters to be processed. NOTE: the vendor's position is that the product is not intended for untrusted input...

CVE-2022-34913

md2roff 1.7 has a stack-based buffer overflow via a Markdown file containing a large number of consecutive characters to be processed. NOTE: the vendor's position is that the product is not intended for untrusted input...

CVE-2022-34913

md2roff 1.7 has a stack-based buffer overflow via a Markdown file containing a large number of consecutive characters to be processed. NOTE: the vendor's position is that the product is not intended for untrusted input...

Stack overflow

DISPUTED md2roff 1.7 has a stack-based buffer overflow via a Markdown file containing a large number of consecutive characters to be processed. NOTE: the vendor's position is that the product is not intended for untrusted input...

CVE-2022-34913

md2roff 1.7 has a stack-based buffer overflow via a Markdown file containing a large number of consecutive characters to be processed. NOTE: the vendor's position is that the product is not intended for untrusted input...

PT-2022-22432 · Md2Roff · Md2Roff

Name of the Vulnerable Software and Affected Versions: md2roff version 1.7 Description: The issue is a stack-based buffer overflow that occurs when processing a Markdown file containing a large number of consecutive characters. It's noted that the vendor's position is that the product is not...