12259 matches found
libxml2: Heap-based buffer overflow in xmlEncodeEntitiesInternal() in entities.c
There is a flaw in the xml entity encoding functionality of libxml2. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application...
CVE-2022-24675
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data...
Stack overflow
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data...
UBUNTU-CVE-2022-24675
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data...
CVE-2022-24675
CVE-2022-24675 affects the encoding/pem component in Go, where Decode can overflow the stack when processing very large PEM data (reported for Go before 1.17.9 and 1.18.x before 1.18.1). The vulnerability can lead to a denial of service through a stack overflow, impacting availability. Affected r...
Zimbra 安全漏洞
Zimbra Collaboration aka ZCS version 9.0 is vulnerable to a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied data and output. An attacker could exploit the vulnerability to execute JavaScript code on the client side...
CVE-2022-24675
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data...
CVE-2021-23283
Eaton Intelligent Power Protector IPP prior to version 1.69 is vulnerable to stored Cross Site Scripting. The vulnerability exists due to insufficient validation of user input and improper encoding of the output for certain resources within the IPP software...
CVE-2021-23283
Eaton Intelligent Power Protector IPP prior to version 1.69 is vulnerable to stored Cross Site Scripting. The vulnerability exists due to insufficient validation of user input and improper encoding of the output for certain resources within the IPP software...
Cross site scripting
Eaton Intelligent Power Protector IPP prior to version 1.69 is vulnerable to stored Cross Site Scripting. The vulnerability exists due to insufficient validation of user input and improper encoding of the output for certain resources within the IPP software...
Intelligent Power Protector跨站脚本漏洞
Intelligent Power Protector is a Intelligent Power Software. A cross-site scripting vulnerability exists in Eaton Intelligent Power Protector IPP prior to version 1.69, which stems from insufficient validation of user input and improper encoding of output for certain resources in the IPP software...
Exploit for Expression Language Injection in Apache Struts
Struts2S2-062CVE-2021-31805 Apache Struts2 S2-062 remote c...
The vulnerability of the Git-based software platform for collaborative code development on GitLab stems from a lack of mechanisms for encoding or shielding output data. This allows attackers to gain access to confidential information.
The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to confidential data...
The vulnerability in the implementation of the Hypertext Transfer Protocol (HTTP/1.1) of the Eclipse Jetty server container allows a attacker to send hidden HTTP requests (HTTP Request Smuggling attack).
The vulnerability of the Hypertext Transfer Protocol HTTP/1.1 implementation in Eclipse Jetty servers is related to deficiencies in handling the Transfer-Encoding and Content-Length headers. Exploiting this vulnerability allows a malicious actor to send hidden HTTP requests remotely a type of HTT...
tomcat: HTTP request smuggling when used with a reverse proxy
Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer...
Regular Expression Denial of Service (ReDoS)
Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS due to an expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Details Denial...
go -- multiple vulnerabilities
The Go project reports: encoding/pem: fix stack overflow in Decode. A large more than 5 MB PEM input can cause a stack overflow in Decode, leading the program to crash. crypto/elliptic: tolerate all oversized scalars in generic P-256. A crafted scalar input longer than 32 bytes can cause...
DEBIAN-CVE-2022-24836
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri = 1.13.4. There are no known workarounds for this issue...
