PT-2022-20463 · Vapor · Vapor

Name of the Vulnerable Software and Affected Versions: Vapor versions prior to 4.61.1 Description: The issue is related to unbounded, attacker-controlled stack growth, which can lead to a stack overflow and a process crash when using automatic content decoding. An attacker can craft a request bod...

CVE-2022-32265

qDecoder before 12.1.0 does not ensure that the percent character is followed by two hex digits for URL decoding...

CVE-2022-32265

qDecoder before 12.1.0 does not ensure that the percent character is followed by two hex digits for URL decoding...

Design/Logic Flaw

qDecoder before 12.1.0 does not ensure that the percent character is followed by two hex digits for URL decoding...

CVE-2022-32265

qDecoder before 12.1.0 does not ensure that the percent character is followed by two hex digits for URL decoding...

CVE-2022-32265

qDecoder before 12.1.0 does not ensure that the percent character is followed by two hex digits for URL decoding...

CVE-2022-32265

CVE-2022-32265 affects the qDecoder library prior to version 12.1.0. The root cause is improper URL decoding where a percent character may not be followed by two hex digits, leading to input validation gaps. Affected component: qDecoder (C/C++ CGI library). Impact is described as input validation...

CVE-2022-32265

qDecoder before 12.1.0 does not ensure that the percent character is followed by two hex digits for URL decoding...

CVE-2022-32265: Undefined Security Weakness

qDecoder before 12.1.0 does not ensure that the percent character is followed by two hex digits for URL decoding...

The vulnerability in the implementation of the OPENSSL_LHflush() function in the OpenSSL library allows a attacker to cause a service failure.

The vulnerability of the OPENSSLLHflush function implementation in the OpenSSL library is related to the repeated use of memory during the flushing of the hash table when decoding certificates or keys. Exploiting this vulnerability could allow a malicious actor to cause service failures...

PT-2022-21190

Name of the Vulnerable Software and Affected Versions qDecoder versions prior to 12.1.0 Description The issue arises from the failure to ensure that the percent character is followed by two hex digits for URL decoding. This can lead to potential security issues. Recommendations For versions prior...

AZL-9909 CVE-2022-27780 affecting package curl for versions less than 7.83.1-1

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a different URL usingthe wrong host name when it is later retrieved.For example, a URL like http://example.com%2F127.0.0.1/, would be allowed bythe parser and get...

PYSEC-2022-202

PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can...

Exploit for Unrestricted Upload of File with Dangerous Type in Artica Pandora_Fms

Exploit for CVE-2020-5844 Pandora FMS v7.0NG.742 - Remote Co...

LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619 allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources the fix is available with commit b4e79bfa.

...

PT-2022-36995

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read error. Technical details include the crash type being a Heap-buffer-overflow READ 2, with the crash sta...

PT-2022-36991

Name of the Vulnerable Software and Affected Versions OpenEXR affected versions not specified Description The issue is related to a heap buffer overflow read. Technical details about the crash include the generic unpack and exr decoding run functions, as well as the Imf 3 2::checkCoreFile functio...

Crash when decoding malformed HTTP requests or malformed JSON payload

When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught exception. Parsing chunked HTTP requests with trailers can lead to a libprocess crash too because of the mistakenly planted assertion. A malicious actor can therefore cause a...

Denial of service in Apache Mesos

When handling a decoding failure for a malformed URL path of an HTTP request, libprocess in Apache Mesos might crash because the code accidentally calls inappropriate function. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster...

GHSA-X869-784M-JMJ2 Denial of service in Apache Mesos

When handling a decoding failure for a malformed URL path of an HTTP request, libprocess in Apache Mesos might crash because the code accidentally calls inappropriate function. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster...