DEBIAN-CVE-2021-44496

An issue was discovered in FIS GT.M through V7.0-000 related to the YottaDB code base. Using crafted input, an attacker can control the size variable and buffer that is passed to a call to memcpy. An attacker can use this to overwrite key data structures and gain control of the flow of execution...

CVE-2021-44497

An issue was discovered in FIS GT.M through V7.0-000 related to the YottaDB code base. Using crafted input, can cause the bounds of a for loop to be miscalculated, which leads to a use after free condition a pointer is pushed into previously free memory by the loop...

UBUNTU-CVE-2021-44505

An issue was discovered in FIS GT.M through V7.0-000 related to the YottaDB code base. Using crafted input, an attacker can cause a NULL pointer dereference after calls to ZPrint...

UBUNTU-CVE-2021-44501

An issue was discovered in FIS GT.M through V7.0-000 related to the YottaDB code base. Using crafted input, an attacker can cause calls to ZRead to crash due to a NULL pointer dereference...

CVE-2021-39080

Due to weak obfuscation, IBM Cognos Analytics Mobile for Android application prior to version 1.1.14 , an attacker could be able to reverse engineer the codebase to gain knowledge about the programming technique, interface, class definitions, algorithms and functions used. IBM X-Force ID: 215593...

Design/Logic Flaw

Due to weak obfuscation, IBM Cognos Analytics Mobile for Android application prior to version 1.1.14 , an attacker could be able to reverse engineer the codebase to gain knowledge about the programming technique, interface, class definitions, algorithms and functions used. IBM X-Force ID: 215593...

Rumkin Keyget 安全漏洞

Rumkin Keyget is a Js-based codebase for objects that can be modified by Rumkin's individual developers. A security vulnerability exists in Rumkin Keyget that can be exploited by an attacker to cause a denial of service and potentially lead to remote code execution...

CVE-2022-21658

Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the std::fs::removedirall standard library function is vulnerable a race condition enabling symlink following CWE-363. A...

icedtea-web 数据伪造问题漏洞

icedtea-web is an open source implementation of JSR-56 Java Web Launching Protocol and API. icedtea-web is vulnerable to a data forgery issue vulnerability that stems from not properly determining the origin of an applet when performing a same-origin check. An attacker could use this vulnerabilit...

CVE-2021-36547

A remote code execution RCE vulnerability in the component /codebase/dir.php?type=filenew of Mara v7.5 allows attackers to execute arbitrary commands via a crafted PHP file...

CVE-2021-36547

Summary: Mara CMS v7.5 contains a remote code execution (RCE) vulnerability in the component /codebase/dir.php?type=filenew. The root cause is alleged improper input filtering in the file upload logic, enabling an attacker to upload a crafted PHP file that can execute arbitrary commands. This iss...

CVE-2021-39516

An issue was discovered in libjpeg through 2020021. A NULL pointer dereference exists in the function HuffmanDecoder::Get located in huffmandecoder.hpp. It allows an attacker to cause Denial of Service...

Partial read is incorrect in molecule

Impact Anyone who uses totalsize.. function to partial read the length of any FixVec will get an incorrect result, due to an incorrect implementation. This has been resolved in the 0.7.2 release. Workarounds If you already have the whole FixVec A, you can use A.asslice.len to get the total size o...

auth only works well with external functions

Handle gpersoon Vulnerability details Impact The auth modifier of AccessControl.sol doesn't work as you would expect. It checks if you are authorized for "msg.sig", however msg.sig is the signature of the first function you have called, not of the current function. So if you call function A, whic...

[SECURITY] Fedora 34 Update: python-starlette-0.14.2-6.fc34

Starlette is a lightweight ASGI framework/toolkit, which is ideal for build ing high performance asyncio services. It is production-ready, and gives you the following: Seriously impressive performance. WebSocket support. GraphQL support. In-process background tasks. Startup and shutdown events...

GHSA-WGPJ-7C2J-VFJM Indico Tampering with links (e.g. password reset) in sent emails

Impact An external audit of the Indico codebase has discovered a vulnerability in Indico's URL generation logic which could have allowed an attacker to make Indico send a password reset link with a valid token pointing to an attacker-controlled domain by sending that domain in the Host header. Ha...

yeikos js.merge security vulnerability

yeikos js.merge is an application by the individual developers at Yeikos USA. It provides tools for merging js. A security vulnerability exists in yeikos js.merge. The vulnerability stems from the fact that all merges of related branches are susceptible to the prototype of this codebase. The...

Eclipse Californium Denial of Service Vulnerability

Eclipse Californium is a Java-based codebase from the Eclipse Foundation that provides Coap back-end support for the Internet of Things. A security vulnerability exists in Eclipse Californium versions 2.3.0 through 2.6.0, which stems from DTLS server-side persistence of incorrect internal state. ...

phpGACL template multiple cross-site scripting vulnerabilities

Summary Multiple cross-site scripting vulnerabilities exist in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnerability. Tested Versions phpGACL 3.3.7 OpenEMR 5.0.2...

GoDaddy Node-config-shield Security Vulnerability

GoDaddy Node-config-shield is a Javascript-based codebase for checking sensitive information in projects by GoDaddy, Inc. A security vulnerability exists in GoDaddy node-config-shield that stems from a call to eval while processing the set command...