7693 matches found
Debian: Security Advisory (DLA-2678-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
wget2:libwget_css_url_fuzzer: Crash with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=5961382498533376 Project: wget2 Fuzzing Engine: libFuzzer Fuzz Target: libwgetcssurlfuzzer Job Type: libfuzzerasanwget2 Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x4f7b3099dee6 Crash State: NULL Sanitizer: address ASAN Recommend...
Unspecified vulnerability in css-what
css-what is a CSS selector parser. A security vulnerability exists in css-what versions prior to 5.0.1, which stems from the fact that the css-what package does not ensure that property parsing has linear time complexity with respect to input size. No details of the vulnerability are available at...
CVE-2021-33587
A flaw was found in nodejs-css-what. The css-what package for Node.js does not ensure that attribute parsing has a Linear Time Complexity relative to the size of the input. The highest threat from this vulnerability is to system availability...
Denial Of Service (DoS)
css-what is vulnerable to denial of service. The vulnerability exists due to the system not ensuring that the attribute handler has Linear Time Complexity LTC relative to the size of the input causing the system to overload on the resource and crashing the system...
PT-2021-28734
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.12.4 Description The issue is related to a use after free in the atomisp alloc css stat bufs function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...
PT-2021-28835
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.37 Description The issue is related to a use after free in the atomisp alloc css stat bufs function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...
PT-2021-24841
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.37 Description: The issue is related to a use after free in the atomisp alloc css stat bufs function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...
FooGallery < 2.0.35 - Authenticated Stored Cross-Site Scripting
In the plugin, the Custom CSS field of each gallery is not properly sanitised or validated before being being output in the page where the gallery is embed, leading to a stored Cross-Site Scripting issue. PoC Create or edit a gallery and add the following payload in the Custom CSS field:...
PT-2021-24740
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.12.4 Description The issue is related to a use after free in the atomisp alloc css stat bufs function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...
FooGallery < 2.0.35 - Authenticated Stored Cross-Site Scripting
In the plugin, the Custom CSS field of each gallery is not properly sanitised or validated before being being output in the page where the gallery is embed, leading to a stored Cross-Site Scripting issue. Create or edit a gallery and add the following payload in the Custom CSS field: Then, view t...
CVE-2021-33587
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input...
CVE-2021-33587
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input...
DEBIAN-CVE-2021-33587
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input...
CVE-2021-33587
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input...
CVE-2021-33587: Undefined Security Weakness
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input...
CVE-2021-33587
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input...
5ug-cli (>=1.0.72, <=1.4.0), @11ty/eleventy-plugin-syntaxhighlight (>=3.1.0, <=3.1.1) +170 more potentially affected by CVE-2021-33587 via css-what (4.0.0)
css-what NPM version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on css-what and may be impacted: - 5ug-cli =1.0.72, =3.1.0, =0.0.1, =0.4.0-next.8, =0.4.0-next.8, =0.4.0-next.8, =2.8.1-canary.0, =2.7.6, =2.8.0-canary.5, =1.0.0-alpha.0, =1.0.0,...
CVE-2021-33587
CVE-2021-33587 affects the css-what package for Node.js (versions 4.0.0 through 5.0.0). The vulnerability arises from non-linear attribute parsing, which could lead to degraded performance or availability impacts as input size grows. The connected IBM/OSS references note a fixed release, with the...
CSS-What security vulnerability
css-what is a CSS selector parser. A security vulnerability exists in css-what versions prior to 5.0.1, which stems from the fact that the css-what package does not ensure that property parsing has linear time complexity with respect to input size. No details of the vulnerability are available at...