GPAC安全漏洞

GPAC is a multimedia framework for rich media and is distributed under the LGPL license. a buffer overflow vulnerability exists in the stblAppendSize function in MP4Box in GPAC version 1.0.1. An attacker can exploit this vulnerability via specially crafted files to cause a denial of service or...

OSV-2021-955 Stack-buffer-overflow in Buffer_AppendIndentUnchecked

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36009 Crash type: Stack-buffer-overflow WRITE 1 Crash state: BufferAppendIndentUnchecked encode encode...

OSV-2021-850 Heap-buffer-overflow in proto_item_append_text

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35102 Crash type: Heap-buffer-overflow READ 8 Crash state: protoitemappendtext dissectpfcp3gppenterpriseies calldissectorwork...

OSV-2021-563 Heap-use-after-free in AK::NonnullOwnPtr<JS::IndexedPropertyStorage>::operator->

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32459 Crash type: Heap-use-after-free READ 8 Crash state: AK::NonnullOwnPtr::operator- JS::IndexedProperties::arraylikesize JS::IndexedProperties::append...

CVE-2021-28543

Varnish varnish-modules before 0.17.1 allows remote attackers to cause a denial of service daemon restart in some configurations. This does not affect organizations that only install the Varnish Cache product; however, it is common to install both Varnish Cache and varnish-modules. Specifically, ...

CVE-2021-27197

DSUtility.dll in Pelco Digital Sentry Server before 7.19.67 has an arbitrary file write vulnerability. The AppendToTextFile method doesn't check if it's being called from the application or from a malicious user. The vulnerability is triggered when a remote attacker crafts an HTML page e.g., with...

How to redirect to the same site using different URL append

This article will help you to configure a redirect policy to properly use different URL appends to reach the same site...

VulnCheck KEV: CVE-2020-11022

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untrusted code. This problem is patched in jQuery 3.5.0...

OSV-2020-2201 Heap-buffer-overflow in String::append

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27912 Crash type: Heap-buffer-overflow READ 3 Crash state: String::append appendidentifier Itemfuncgetuservar::print...

squid: Cross-Site Request Forgery issue in HTTP Request processing

An issue was discovered in Squid 3.x and 4.x through 4.8 when the appenddomain setting is used because the appended characters do not properly interact with hostname length restrictions. Due to incorrect message processing, it can inappropriately redirect traffic to origins it should not be...

libarchive: out-of-bounds read in archive_wstring_append_from_mbs in archive_string.c

In Libarchive 3.4.0, archivewstringappendfrommbs in archivestring.c has an out-of-bounds read because of an incorrect mbrtowc or mbtowc call. For example, bsdtar crashes via a crafted archive...

OSV-2020-640 Stack-buffer-overflow in ot::Message::Write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15447 Crash type: Stack-buffer-overflow READ Crash state: ot::Message::Write ot::Message::Append ot::AddressResolver::SendAddressQueryResponse...

OSV-2020-258 Stack-buffer-overflow in ot::Message::Write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19338 Crash type: Stack-buffer-overflow READ 11 Crash state: ot::Message::Write ot::Message::Append ot::Mle::Mle::AppendResponse...

OSV-2020-109 UNKNOWN READ in arrow::BufferBuilder::Append

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20721 Crash type: UNKNOWN READ Crash state: arrow::BufferBuilder::Append arrow::BaseBinaryBuilder::Append parquet::ArrowBinaryHelper::Append...

Arbitrary File Read

snyk-broker is vulnerable to information disclosure. The vulnerability exists because it does not properly remove the information after a fragment identifier of the URL, allowing a user with access to Snyk's internal network to read arbitrary file by appending the URL with a fragment identifier a...

Unspecified Vulnerability in KDE KMail (CNVD-2021-31481)

KDE KMail is an e-mail component of Kontact personal information management suite from the KDE community. A security vulnerability exists in KDE KMail versions prior to 19.12.3. An attacker could use this vulnerability to cause KMail to append a local file to a written email message without...

Privilege Escalation

dovecot is vulnerable to privilege escalation. A flaw was found in the Dovecot ACL plug-in. User with only insert permissions for a mailbox could use the "COPY" and "APPEND" commands to set additional message flags...

Secdo: Privilege escalation via hardcoded script path

Secdo tries to execute a script at a hardcoded path if present, which allows a local authenticated user with 'create folders or append data' access to the root of the OS disk C:\ to gain system privileges if the path does not already exist or is writable. This issue affects all versions of Secdo...

ICU: Integer overflow in UnicodeString::doAppend()

An issue was discovered in International Components for Unicode ICU for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend function in common/unistr.cpp...

CVE-2019-18677

An issue was discovered in Squid 3.x and 4.x through 4.8 when the appenddomain setting is used because the appended characters do not properly interact with hostname length restrictions. Due to incorrect message processing, it can inappropriately redirect traffic to origins it should not be...