724 matches found
CVE-2021-25944
CVE-2021-25944 relates to a prototype pollution flaw in the npm module deep-defaults affecting versions 1.0.0–1.0.5. The root cause is that the internal function _deepDefaults() assigns properties without validating the input type, enabling an attacker to pollute Object.prototype (e.g., via malic...
deep-defaults 安全漏洞
deep-defaults is a package for npm. A security vulnerability exists in deep-defaults versions 1.0.0 through 1.0.5, which can be exploited by an attacker to cause a denial of service and possibly remote code execution...
PT-2021-16870 · Unknown · Deep-Defaults
Name of the Vulnerable Software and Affected Versions: deep-defaults versions 1.0.0 through 1.0.5 Description: The issue allows an attacker to cause a denial of service and may lead to remote code execution due to a prototype pollution vulnerability in the 'deep-defaults' module. The deepDefaults...
openSUSE: Security Advisory for syncthing (openSUSE-SU-2021:0688-1)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
OPENSUSE-SU-2021:0713-1 Security update for syncthing
This update for syncthing fixes the following issues: Update to 1.15.0/1.15.1 This release fixes a vulnerability where Syncthing and the relay server can crash due to malformed relay protocol messages CVE-2021-21404; see GHSA-x462-89pf-6r5h. boo1184428 This release updates the CLI to use...
rubygem-activeview: Cross-site scripting in translation helpers
A flaw was found in rubygem-actionview in versions prior to 5.2.4.4 and 6.0.3.3. When an HTML-unsafe string is passed as the default for a missing translation key, the default string is incorrectly marked as HTML-safe and not escaped. Thie highest threat from this vulnerability is to data...
Google Android 安全漏洞
Google Android is a Linux-based open source operating system from the USGoogleOpen Handheld Alliance Google. Google Android has a security vulnerability where an eavesdropping vector may exist in onCreate of RequestPermissionActivity.java due to insecure default values. This could lead to a local...
Insecure Default Configuration
Overview Affected versions of socket.io are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default. Recommendation Update to version 2.4.0 or later. References - GitHub Advisory - Snyk Advisory...
CVE-2020-0524
Improper default permissions in the firmware for the IntelR Ethernet I210 Controller series of network adapters before version 3.30 may allow an authenticated user to potentially enable denial of service via local access...
February 16, 2021—KB4601380 (OS Build 18363.1411) Preview
None None...
Intel SSD Toolbox Default Configuration Issue Vulnerability
A Default Configuration Issue vulnerability exists in Intel SSD Toolbox that arises from the use of insecure default configurations on networked systems or products...
CentOS 8 : pki-deps:10.6 (CESA-2019:1529)
The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1529 advisory. - tomcat: Open redirect in default servlet CVE-2018-11784 - tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins...
GHSA-49WP-QQ6X-G2RF Cross-site Request Forgery in fastify-csrf
The package fastify-csrf before 3.0.0 has a set of issues that affect its ability to do CSRF protection. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: path: '/', sameSite: true 2. The CSRF token was available in the GET query parameter...
Cross-site Request Forgery in fastify-csrf
The package fastify-csrf before 3.0.0 has a set of issues that affect its ability to do CSRF protection. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: path: '/', sameSite: true 2. The CSRF token was available in the GET query parameter...
CORS misconfiguration in socket.io
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default...
CVE-2020-28481
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default...
CVE-2020-28481
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default...
AZL-44430 CVE-2020-28481 affecting package js-jquery 3.5.0-4
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default...
CVE-2020-28482
This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: path: '/', sameSite: true 2. The CSRF token was available in the GET query parameter...
