python-flask: Denial of Service via crafted JSON file

The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. Th...

DEBIAN-CVE-2020-6794

If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master...

jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection

A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the extend function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with...

UBUNTU-CVE-2019-5064

An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0. A specially crafted JSON file can cause a buffer overflow, resulting in multiple heap corruptions and potentially code execution. An attacker can provide a...

UBUNTU-CVE-2019-17632

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content in text/html and text/json Content-Type does not escape Exception messages in stacktraces included in error output...

infinispan: deserialization of data in XML and JSON transcoders

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possibl...

DEBIAN-CVE-2019-1010083

The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656...

[SECURITY] Fedora 28 Update: cfitsio-3.430-2.fc28

CFITSIO is a library of C and FORTRAN subroutines for reading and writing data files in FITS Flexible Image Transport System data format. CFITSIO simplifies the task of writing software that deals with FITS files by providing an easy to use set of high-level routines that insulate the programmer...

HDF HDF5 out-of-bounds read vulnerability (CNVD-2019-42548)

HDF5 is a data model, library, and file format for storing and managing data. An out-of-bounds read vulnerability exists in the H5MMxstrdup function in H5MM.c in HDF HDF5 1.10.4 when called from H5Odtypedecodehelper in H5Odtype.c. An attacker could exploit this vulnerability to obtain information...

HDF HDF5 out-of-bounds read vulnerability (CNVD-2019-42550)

HDF5 is a data model, library, and file format for storing and managing data. An out-of-bounds read vulnerability exists in the H5VMmemcpyvv function in H5VM.c in HDF HDF5 1.10.4 when called from H5Dcompactreadvv in H5Dcompact.c. An attacker can exploit this vulnerability to obtain information...

DEBIAN-CVE-2019-9151

An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5VMmemcpyvv in H5VM.c when called from H5Dcompactreadvv in H5Dcompact.c...

UBUNTU-CVE-2019-9152

An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5MMxstrdup in H5MM.c when called from H5Odtypedecodehelper in H5Odtype.c...

HDF HDF5 Buffer Overflow Vulnerability

HDF5 is a data model, library, and file format for storing and managing data. A buffer overflow vulnerability exists in H5Olayoutencode in H5Olayout.c in HDF HDF5 1.10.4 and earlier versions. An attacker can exploit this vulnerability to cause a denial of service via a specially crafted HDF5 file...

UBUNTU-CVE-2019-8398

An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5Tgetsize in H5T.c...

UBUNTU-CVE-2019-8396

A buffer overflow in H5Olayoutencode in H5Olayout.c in the HDF HDF5 through 1.10.4 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while repacking an HDF5 file, aka "Invalid write of size 2."...

PT-2019-19010 · Hdf +3 · Hdf5 +3

Name of the Vulnerable Software and Affected Versions: HDF5 versions prior to 1.10.5 Description: A buffer overflow issue in the HDF5 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while repacking an HDF5 file. Recommendations: For versions...

The vulnerability of the H5O_attr_decode() function in the HDF5 library, which allows a hacker to cause a service failure

The vulnerability of the H5OattrDecode function H5Oattr.c in the HDF5 library arises from the operation leaving the buffer boundaries into memory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to cause service failures by using a specially crafted HDF5 file...

The vulnerability of the applyilters() function in the HDF5 library, which allows a hacker to cause a service failure

The vulnerability of the applyilters function h5repackfilters.c in the HDF5 library is related to a division by zero error. Exploiting this vulnerability could allow an attacker to cause service interruptions remotely...

jackson-dataformat-xml vulnerable to XML external entity (XXE)

XML external entity XXE vulnerability in XmlMapper in the Data format extension for Jackson aka jackson-dataformat-xml allows attackers to have unspecified impact via unknown vectors...

Foxit Reader and Foxit PhantomPDF for Windows Remote Code Execution Vulnerability (CNVD-2018-21826)

Foxit Reader for Windows is a Windows-based PDF document reader from China's Foxit Foxit Software Corporation.Foxit PhantomPDF for Windows is its commercial version. A vulnerability exists in the handling of JSON objects in Foxit Reader 9.2.0.9297 and earlier versions and Foxit PhantomPDF...