1357 matches found
CVE-2020-14343
A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the fullload method or with the FullLoader loader. Applications that use the library to process untrusted input may be...
CVE-2020-14343
A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the fullload method or with the FullLoader loader. Applications that use the library to process untrusted input may be...
Input validation
A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the fullload method or with the FullLoader loader. Applications that use the library to process untrusted input may be...
PYSEC-2021-142
A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the fullload method or with the FullLoader loader. Applications that use the library to process untrusted input may be...
Prototype Pollution
dynamoose is vulnerable to prototype pollution. The vulnerability exists through lib/utils/object/set.ts where an attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...
Prototype Pollution
set-or-get is vulnerable to prototype pollution. An attacker is able to exploit the vulnerability to inject arbitrary properties into existing construct prototypes in function SetOrGet and modify attributes such as proto, constructor and prototype...
CVE-2020-14343
A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the fullload method or with the FullLoader loader. Applications that use the library to process untrusted input may be...
envoy:codec_impl_fuzz_test: Crash in Envoy::Http::HttpStream::HttpStream
Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=4826304595361792 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: codecimplfuzztest Job Type: libfuzzerubsanenvoy Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00001ae185d0 Cras...
Prototype Pollution
Overview merge-deep is a recursively merges values in a javascript object. Affected versions of this package are vulnerable to Prototype Pollution. Merge-deep actively attempts to prevent prototype pollution by blocking object property merges into proto, however it still allows for prototype...
Fedora 32 : PyYAML (2021-eed7193502)
The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-eed7193502 advisory. - A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it process...
tensorflow-py:immutableConst_fuzz: Segv on unknown address in tensorflow::TensorHandle::TensorHandle
Detailed Report: https://oss-fuzz.com/testcase?key=5351196414050304 Project: tensorflow-py Fuzzing Engine: libFuzzer Fuzz Target: immutableConstfuzz Job Type: libfuzzerasantensorflow-py Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State:...
Remote Code Execution (RCE)
rsshub is vulnerable to remote code execution. An attacker is able to inject malicious code via the eval or Function constructor which allows an attacker to inject and execute codes in the system...
CVE-2021-21278
RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 non-semantic versioning there is a risk of code injection. Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side securi...
CVE-2021-21278: Improper Neutralization of Special Elements in Output Used by a Downstream Component
RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 non-semantic versioning there is a risk of code injection. Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side securi...
RSSHub Injection Vulnerability
An injection vulnerability exists in RSSHub that stems from the use of "eval" or "Function constructor" in some routes, leading to server-side security issues...
PT-2021-14384
Name of the Vulnerable Software and Affected Versions: RSSHub versions prior to 7f1c430 Description: RSSHub is an open source, easy to use, and extensible RSS feed generator. The issue arises from some routes using eval or Function constructor, which may be injected by the target site with unsafe...
CVE-2021-21248
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec is used to define parameters of a Build spec. It does so by using dynamically generated Groovy classes. A user able to control job paramete...
CVE-2019-15080
An issue was discovered in a smart contract implementation for MORPH Token through 2019-06-05, an Ethereum token. A typo in the constructor of the Owned contract which is inherited by MORPH Token allows attackers to acquire contract ownership. A new owner can subsequently obtain MORPH Tokens for...
CVE-2019-15079
A typo exists in the constructor of a smart contract implementation for EAI through 2019-06-05, an Ethereum token. This vulnerability could be used by an attacker to acquire EAI tokens for free...
CVE-2019-15078
An issue was discovered in a smart contract implementation for AIRDROPX BORN through 2019-05-29, an Ethereum token. The name of the constructor has a typo wrong case: XBornID versus XBORNID that allows an attacker to change the owner of the contract and obtain cryptocurrency for free...