Prototype Pollution in mootools

This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge...

GHSA-8C3F-X5F9-6H62 Command injection in @diez/generation

The @diez/generation npm package is a client for Diez. The locateFont method of @diez/generation has a command injection vulnerability. Clients of the @diez/generation library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. This issue may lead...

PT-2021-10121 · Craigms · Craigms

Name of the Vulnerable Software and Affected Versions: CraigMS version 1.0 Description: An issue in craigms/main.php allows attackers to execute arbitrary commands via a crafted input entered into the DB Name field. Recommendations: For CraigMS version 1.0, consider restricting access to the...

CVE-2021-23406

A flaw was found in nodejs-pac-resolver. A remote code execution can occur with untrusted input, due to unsafe PAC file handling. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

SUSE SLES12 Security Update : python-PyYAML (SUSE-SU-2021:2818-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2818-1 advisory. - Update to 5.3.1. - CVE-2020-14343: A vulnerability was discovered in the PyYAML library, where it was susceptible to arbitrary code...

CVE-2021-23432

This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge...

Design/Logic Flaw

This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge...

CVE-2021-23432

This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge...

UBUNTU-CVE-2021-23432

This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge...

CVE-2021-23432

CVE-2021-23432 affects all versions of the mootools library. The root cause is the ability to pass untrusted input to Object.merge() , leading to prototype pollution . Several connected sources confirm the issue and the affected component, with CVSS values indicating high to critical impact (netw...

CVE-2021-23432 Prototype Pollution

This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge...

CVE-2021-23432

This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge...

CVE-2021-23406 Remote Code Execution (RCE)

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. NOTE: The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer...

CVE-2021-23406

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. NOTE: The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer...

mootools 安全漏洞

mootools is a library for web development with OOP support. A security vulnerability exists in mootools that allows an attacker to pass untrusted input to the application's Object.merge...

pac-resolver 安全漏洞

pac-resolver is a function that generates an asynchronous parser from a PAC file. A security vulnerability exists in pac-resolver versions prior to 5.0.0 that stems from the application of insecure PAC file handling, which may occur when used with untrusted input...

GHSA-M72M-MHQ2-9P6C Uncaught Exception in jsoup

Impact What kind of vulnerability is it? Who is impacted? Those using jsoup to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until cancelled, to comple...

AZL-7253 CVE-2021-37714 affecting package jsoup 1.11.3-3

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until...

DEBIAN-CVE-2021-37714

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until...

AZL-36945 CVE-2021-37714 affecting package jsoup 1.11.3-4

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until...