5940 matches found
jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck
jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until...
jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck
jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until...
Bentley View Stack Buffer Overflow Vulnerability
Bentley View is a free viewer from Bentley Systems, U.S.A. Bentley View is vulnerable to a stack buffer overflow vulnerability that exists due to a boundary error in the handling of untrusted input. An attacker could exploit this vulnerability to execute arbitrary code on the system...
Bentley Systems Bentley View 缓冲区错误漏洞
Bentley View is a free viewer from Bentley Systems, U.S.A. Bentley View is vulnerable to a stack buffer overflow vulnerability that exists due to a boundary error in the handling of untrusted input. An attacker could exploit this vulnerability to execute arbitrary code on the system...
CVE-2021-43033
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Multiple functions in the bpserverd daemon were vulnerable to arbitrary remote code execution as root. The vulnerability was caused by untrusted input received by the server being passed to system calls...
CVE-2021-43033
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Multiple functions in the bpserverd daemon were vulnerable to arbitrary remote code execution as root. The vulnerability was caused by untrusted input received by the server being passed to system calls...
DEBIAN-CVE-2021-38000
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page...
Internet Bug Bounty: Ruby - Regular Expression Denial of Service Vulnerability of Date Parsing Methods
Official report: https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/ CVE-2021-41817 Here are the details from the official article: Date’s parsing methods including Date.parse are using Regexps internally, some of which are vulnerable against regular...
rubygem-actionpack: Possible Information Disclosure / Unintended Method Execution in Action Pack
A flaw was found in rubygem-actionpack. Information disclosure or unintended method execution is possible when using the redirectto or polymorphicurl helper with untrusted user input. The highest threat from this vulnerability is to data confidentiality...
PyYAML: incomplete fix for CVE-2020-1747
A vulnerability was discovered in the PyYAML library, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the fullload method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw...
jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck
jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until...
jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck
jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until...
Remote Code Execution (RCE)
gerbv is vulnerable to remote code execution. The vulnerability exists due to a boundary error when processing untrusted input in the drill format T-code tool number functionality...
glibc: Arbitrary read in wordexp()
An integer overflow flaw was found in glibc that may result in reading of arbitrary memory when wordexp is used with a specially crafted untrusted regular expression input...
openjpeg: heap-based buffer overflow in functions opj_pi_next_rlcp, opj_pi_next_rpcl and opj_pi_next_lrcp in openjp2/pi.c
A flaw was found in the src/lib/openjp2/pi.c function of OpenJPEG. This flaw allows an attacker who can provide untrusted input to OpenJPEG’s conversion/encoding functionality to cause an out-of-bounds read. The highest impact from this vulnerability is to system availability...
Remote Code Execution (RCE)
chrome is vulnerable to remote code execution. The vulnerability exists due to an Insufficient validation of untrusted input in Intents...
Tenda AC-10U Buffer Overflow Vulnerability
The Tenda AC-10U is a wireless router from Tenda, a Chinese company. A buffer overflow vulnerability exists in the Tenda AC-10U AC1200 router due to a boundary error when handling untrusted input. A remote attacker could execute arbitrary code via the timeZone parameter of goform/SetSysTimeCfg...
Adobe Media Encoder memory corruption vulnerability
A memory corruption vulnerability exists in Adobe Media Encoder, an audio and video encoding application from Adobe, which stems from a boundary error when handling untrusted input. An attacker could use this vulnerability to trigger memory corruption and execute arbitrary code on the target syst...
Microsoft .NET Framework Remote Code Execution Vulnerability
Microsoft .NET Framework contains a remote code execution vulnerability when processing untrusted input that could allow an attacker to take control of an affected system...