226 matches found
xortool
xortool.py A tool to do some xor analysis: guess the key length based on count of equal chars guess the key base on knowledge of most frequent char Notice: xortool is now only running on Python 3. The old Python 2 version is accessible at the py2 branch. The pip package has been updated...
CVE-2026-44267
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse, bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the memberaccess handler in src/transform.ts does not reject...
CVE-2026-44266
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping , so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint...
CVE-2026-44267 Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse, bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the memberaccess handler in src/transform.ts does not reject...
CVE-2026-44267 Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse, bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the memberaccess handler in src/transform.ts does not reject...
CVE-2026-44267
The Elo expression language for no-code tools is vulnerable to code execution prior to version 1.0.1 . Attackers can use .constructor.constructor in plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try to access the JavaScript Function constructor. This occurs be...
Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels
Summary Elo's Ruby backend emits attacker-controlled text into Ruby double-quoted strings without escaping the character. Because begins Ruby's interpolation sequences — expr, @ivar, @@cvar, $gvar — and any expression wrapped in ... may use backticks for shell execution, an Elo program that...
CVE-2026-44266 Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping , so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint...
CVE-2026-44266
The Elo expression language (versions prior to 1.0.1 ) contains a vulnerability in its Ruby backend (src/compilers/ruby.ts). The issue arises because attacker-controlled text is embedded into Ruby double-quoted strings without escaping the # character. This allows Ruby interpolation forms in the ...
CVE-2026-44266 Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping , so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint...
CVE-2026-44266: enspirit elo: Elo is a purely functional expression language for no-code tools
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping , so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint...
Astra Linux – Vulnerability in RustC
A issue was discovered in the Bidirectional Algorithm in the Unicode Specification through version 14.0. This algorithm allows for the visual reordering of characters through control sequences, which can be used to create source code that implements logic different from the logical order of token...
Malicious code in crytic-compilers (PyPI)
--- Credit: OpenSSF source...
[SECURITY] Fedora 44 Update: opam-2.5.2-1.fc44
Opam is a source-based package manager for OCaml. It supports multiple simultaneous compiler installations, flexible package constraints, and a Git-friendly development workflow...
[SECURITY] Fedora 43 Update: opam-2.5.2-1.fc43
Opam is a source-based package manager for OCaml. It supports multiple simultaneous compiler installations, flexible package constraints, and a Git-friendly development workflow...
[SECURITY] Fedora 43 Update: perl-ExtUtils-Builder-Compiler-0.036-1.fc43
This is an interface wrapping around different compilers. It's usually not used directly but by a portability layer like ExtUtils::Builder::Autodetect::C...
[SECURITY] Fedora 44 Update: opam-2.5.1-1.fc44
Opam is a source-based package manager for OCaml. It supports multiple simultaneous compiler installations, flexible package constraints, and a Git-friendly development workflow...
[SECURITY] Fedora 43 Update: opam-2.5.1-1.fc43
Opam is a source-based package manager for OCaml. It supports multiple simultaneous compiler installations, flexible package constraints, and a Git-friendly development workflow...
