4175 matches found
DEBIAN-CVE-2021-45847
Several missing input validations in the 3MF parser component of Slic3r libslic3r 1.3.0 can each allow an attacker to cause an application crash using a crafted 3MF input file...
Input validation
Several missing input validations in the 3MF parser component of Slic3r libslic3r 1.3.0 can each allow an attacker to cause an application crash using a crafted 3MF input file...
CVE-2021-45847
Several missing input validations in the 3MF parser component of Slic3r libslic3r 1.3.0 can each allow an attacker to cause an application crash using a crafted 3MF input file...
PT-2022-28165 · Unknown · Com.Upokecenter.Cbor
Name of the Vulnerable Software and Affected Versions: com.upokecenter.cbor Java implementation of Concise Binary Object Representation CBOR versions 4.0.0 through 4.5.1 Description: The issue is related to inefficient algorithmic complexity in the DecodeFromBytes function, which allows an attack...
Design/Logic Flaw
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings...
UBUNTU-CVE-2022-23305
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings...
jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck
jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until...
USN-5215-1 nltk vulnerability
Srikantha Prathi discovered that NLTK incorrectly handled specially crafted input. An attacker could use this vulnerability to cause a denial of service...
USN-5215-1: NLTK vulnerability
Srikantha Prathi discovered that NLTK incorrectly handled specially crafted input. An attacker could use this vulnerability to cause a denial of service...
libde265 安全漏洞
Libde265 is a German h.265 video codec. libde265 suffers from a security vulnerability that could be exploited by an attacker to cause a denial of service DoS by running a crafted file or application with unspecified other impact...
EulerOS Virtualization 3.0.2.6 : binutils (EulerOS-SA-2021-2903)
According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in bfdpefparsefunctionstubs of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafte...
Giftrans 缓冲区错误漏洞
giftrans is used to convert any Gif file to Gif89a. giftrans has a security vulnerability that stems from the fact that the giftrans function in giftrans 1.12.2 contains a stack-based buffer overflow, since the value in the input file determines the amount of data to be written. An attacker could...
EulerOS 2.0 SP8 : openjpeg2 (EulerOS-SA-2021-2808)
According to the versions of the openjpeg2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjp...
CVE-2021-44859
An out-of-bounds read vulnerability exists when reading a TGA file using Open Design Alliance Drawings SDK before 2022.12. The specific issue exists after loading TGA files. An unchecked input data from a crafted TGA file leads to an out-of-bounds read. An attacker can leverage this vulnerability...
The vulnerability of the Xstream Java library for converting objects into XML or JSON formats stems from deficiencies in the deserialization mechanism. This allows attackers to gain access to protected information and replace objects on the server side.
The vulnerability of the Xstream Java library for converting objects into XML or JSON formats is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability can allow an attacker to gain access to protected information and replace objects on the server side by...
nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes
A regular expression denial of service ReDoS vulnerability was found in nodejs-ansi-regex. This could possibly cause an application using ansi-regex to use an excessive amount of CPU time when matching crafted ANSI escape codes...
jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck
jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until...
netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data
A flaw was found in Netty's netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service...
XStream: Unsafe deserizaliation of com.sun.org.apache.bcel.internal.util.ClassLoader
A flaw was found in xstream. A remote attacker may be able to execute arbitrary code only by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...
USN-5192-1 apache-log4j2 vulnerability
Chen Zhaojun discovered that Apache Log4j 2 allows remote attackers to run programs via a special crafted input. An attacker could use this vulnerability to cause a denial of service or possibly execute arbitrary code. Please see the following link for more information:...