An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file as demonstrated by input that only contains the "exception" keyword.

...

ALPINE-CVE-2021-20270

An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML SML source file, as demonstrated by input that only contains the "exception" keyword...

DEBIAN-CVE-2021-20270

An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML SML source file, as demonstrated by input that only contains the "exception" keyword...

GHSA-JGWR-3QM3-26F3 Potential remote code execution in Apache Tomcat

The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the...

GHSA-5FVX-2JJ3-6MFF Insufficiently Protected Credentials in Elasticsearch

Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in...

CVE-2021-20627

Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors...

UBUNTU-CVE-2020-1900

When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property array before inserting anything into it. Otherwise the array might resize, invalidating previously stored references. This pre-reservation was not occurring in HHVM prior to v4.32....

Bloomreach Experience Manager 安全漏洞

Bloomreach Experience Manager is an application from Bloomreach USA. which provides AI-driven search and merchandising tools. A security vulnerability exists in Bloomreach Experience Manager brXM 4.1.0 through 14.2.2, which originates from a vulnerability that could allow a remote attacker to...

PT-2022-6828 · Haproxy +6 · Haproxy +6

Name of the Vulnerable Software and Affected Versions: HAProxy versions 2.1 through 2.7 before 2.7.1 HAProxy version 2.2 before 2.2.27 HAProxy version 2.3 HAProxy version 2.4 before 2.4.21 HAProxy version 2.5 before 2.5.11 HAProxy version 2.6 before 2.6.8 Description: An information leak issue wa...

PT-2021-7335 · Avahi +8 · Avahi +8

Name of the Vulnerable Software and Affected Versions: Avahi versions 0.6 up to 0.8 Description: The issue is related to the client work function in the Avahi service discovery system, which can lead to an infinite loop due to a condition with no exit. This can be exploited by an attacker to caus...

Weseek GROWI 跨站脚本漏洞

Weseek GROWI is a suite of team collaboration software from Weseek Japan. A stored cross-site scripting vulnerability exists in the administrator page in GROWI 4.2.0 - 4.2.7. An attacker can exploit this vulnerability to execute arbitrary script in a logged-in user's web browser...

Joomla! cross-site scripting vulnerability (CNVD-2021-15050)

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A cross-site scripting vulnerability exists in Joomla! 2.5.0 - 3.9.24. The...

PT-2021-15384 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 2.5.0 through 3.9.24 Description: An issue was discovered that could lead to xss issues due to missing filtering of messages shown to users. Recommendations: For Joomla! versions 2.5.0 through 3.9.24, update to a version that...

PT-2021-15386 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.2.0 through 3.9.24 Description: An issue was discovered in the template manager due to missing input validation. Recommendations: For versions 3.2.0 through 3.9.24, update to a version that includes input validation in the...

CVE-2021-23126

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of the insecure rand function within the process of generating the 2FA secret...

Joomla 路径遍历漏洞

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A path traversal vulnerability exists in Joomla! 3.0.0 - 3.9.24. An attacker can...

Apache Tomcat 信息泄露漏洞

Apache Tomcat is the United States Apache Apache Foundation of a lightweight Web application server. The program implements support for Servlet and JavaServer Page JSP. An information disclosure vulnerability exists in Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to...

object-collider 安全漏洞

Vladyslav Tkachenko object-collider is an open source application by Vladyslav Tkachenko. Provides the ability to merge original old objects without source code modification, and optionally provide custom merge behavior for each specific sub-path A security vulnerability exists in object-collider...

125softnlp (0.0.1), a2 (>=0.10.11, <=0.10.13) +4965 more potentially affected by unknown CVE via tensorflow (>=1.0.1, <=2.21.0)

tensorflow PYPI version =1.0.1, =0.10.11, =0.1.0, =0.0.0, =0.10.11, =0.5.0, =0.1.6, =1.0.0, =2.0.0, =1.0.0, =0.0.1, =0.0.7 and more Source cves: unknown CVE Source advisory: OSV:OSV-2021-449...

PT-2021-17412 · Grafana +6 · Grafana +6

Name of the Vulnerable Software and Affected Versions: Grafana versions 6.7.3 through 7.4.1 Description: The snapshot feature in Grafana can allow an unauthenticated remote attacker to trigger a Denial of Service via a remote API call if a commonly used configuration is set. This issue is related...