4170 matches found
CVE-2020-35149
lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property e.g., proto can be copied during a merge or clone operation...
Mquery Security Vulnerability
Aheckmann Mquery is a Javascript-based codebase for efficiently generating Mongdb query statements from the individual developer Aheckmann. A security vulnerability exists in mquery lib/utils.js versions prior to 3.2.3, which allows contamination attacks because a special attribute e.g. proto can...
PT-2020-17268
Name of the Vulnerable Software and Affected Versions mquery versions prior to 3.2.3 Description The issue allows a pollution attack because a special property, such as proto , can be copied during a merge or clone operation. This occurs in the lib/utils.js file. Recommendations For versions prio...
CVE-2020-35149: Undefined Security Weakness
lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property e.g., proto can be copied during a merge or clone operation...
RUSTSEC-2020-0091 Dangling reference in `access::Map` with Constant
Using the arcswap::access::Map with the Constant test helper or with user-provided implementation of the Access trait could sometimes lead to the map returning dangling references. Replaced by implementation without unsafe, at the cost of added Clone bound on the closure and small penalty on...
Dangling reference in `access::Map` with Constant
Using the arcswap::access::Map with the Constant test helper or with user-provided implementation of the Access trait could sometimes lead to the map returning dangling references. Replaced by implementation without unsafe, at the cost of added Clone bound on the closure and small penalty on...
PT-2020-16362
Name of the Vulnerable Software and Affected Versions Git Credential Manager Core versions prior to 2.0.289 Description The issue arises when recursively cloning a Git repository on Windows with submodules. If a malicious git.exe executable is present in the top-level repository, it will be start...
CVE-2020-26236
In ScratchVerifier before commit a603769, an attacker can hijack the verification process to log into someone else's account on any site that uses ScratchVerifier for logins. A possible exploitation would follow these steps: 1. User starts login process. 2. Attacker attempts login for user, and i...
GHSA-23F7-99JX-M54R Remote code execution in dependabot-core branch names when cloning
Impact Remote code execution vulnerability in dependabot-common and dependabot-gomodules when a source branch name contains malicious injectable bash code. For example, if Dependabot is configured to use the following source branch name: "/$curl,127.0.0.1", Dependabot will make a HTTP request to...
Remote code execution in dependabot-core branch names when cloning
Impact Remote code execution vulnerability in dependabot-common and dependabot-gomodules when a source branch name contains malicious injectable bash code. For example, if Dependabot is configured to use the following source branch name: "/$curl,127.0.0.1", Dependabot will make a HTTP request to...
PT-2020-16351
Name of the Vulnerable Software and Affected Versions Dependabot-Core versions 0.119.0.beta1 through 0.125.1 Description There is a remote code execution issue in dependabot-common and dependabot-go modules when a source branch name contains malicious injectable bash code. For example, if...
Remote code execution in dependabot-core branch names when cloning
Impact Remote code execution vulnerability in dependabot-common and dependabot-gomodules when a source branch name contains malicious injectable bash code. For example, if Dependabot is configured to use the following source branch name: "/$curl,127.0.0.1", Dependabot will make a HTTP request to...
Use-after-free when cloning a partially consumed `Vec` iterator
The IntoIter Clone implementation clones the whole underlying Vec. If the iterator is partially consumed the consumed items will be copied, thus creating a use-after-free access. A proof of concept is available in the original bug report...
RUSTSEC-2020-0145 Use-after-free when cloning a partially consumed `Vec` iterator
The IntoIter Clone implementation clones the whole underlying Vec. If the iterator is partially consumed the consumed items will be copied, thus creating a use-after-free access. A proof of concept is available in the original bug report...
PT-2020-17646
Name of the Vulnerable Software and Affected Versions heapless crate versions prior to 0.6.1 Description The issue arises from the IntoIter Clone implementation, which clones the entire underlying Vec without considering whether it has already been partially consumed. This can lead to a...
The vulnerability of the Clone function in the GLPI system, which handles requests, incidents, and inventory management of computer equipment, allows a hacker to execute arbitrary SQL commands.
The vulnerability of the Clone function in the GLPI system for requests, incidents, and inventory management is related to the improper elimination of special elements used in SQL queries. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands remotely...
FS Thumbtack Clone SQL Injection (CVE-2017-17589; CVE-2017-17576)
An SQL injection vulnerability exists in FS Thumbtack Clone. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary SQL commands on the affected system...
An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation clone can have a memory-safety issue upon a panic.
...
