CVE-2021-39157

The CVE-2021-39157 entry relates to detect-character-encoding, a library where data matching with no charset in versions ≤0.6.0 can crash a Node.js process. The issue is resolved by upgrading to v0.7.0, as documented in Red Hat and GHSA advisories, with no workaround provided. Impact is a crash/d...

CVE-2021-39157 Improper Handling of Exceptional Conditions in detect-character-encoding

detect-character-encoding is an open source character encoding inspection library. In detect-character-encoding v0.6.0 and earlier, data matching no charset causes the Node.js process to crash. The problem has been patched in detect-character-encoding v0.7.0. No workaround are available and all...

detect-character-encoding 安全漏洞

detect-character-encoding is an open source C++ plugin. A security vulnerability exists in detect-character-encoding, which stems from an authorization bypass vulnerability found in istio istio. Case-insensitive host comparisons were incorrect when computing rules specified with host or notHost...

DEBIAN-CVE-2021-3694

LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure...

CVE-2021-3694

LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure...

CVE-2021-3694

LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure...

CVE-2021-3694

LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure...

UBUNTU-CVE-2021-3694

LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure...

CVE-2021-3694

LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure...

CVE-2021-3694

LedgerSMB has a vulnerability where error messages were not sufficiently HTML-encoded, allowing an authenticated user to exploit a specially crafted URL to trigger remote code execution and information disclosure. The issue is documented across multiple advisories (CVE-2021-3694 and related CVEs)...

PT-2021-21414 · Ledgersmb +2 · Ledgersmb +2

Name of the Vulnerable Software and Affected Versions: LedgerSMB affected versions not specified Description: The issue arises from insufficient HTML-encoding of error messages sent to the browser. This can be exploited by sending a specially crafted URL to an authenticated user, potentially...

LedgerSMB 跨站脚本漏洞

LedgerSMB is a free web-based double-entry bookkeeping system with quoting, ordering, invoicing, projects, time cards, inventory management, shipping, etc. A cross-site scripting vulnerability exists in LedgerSMB, which stems from the application's failure to adequately encode HTML for error...

PT-2021-6751 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.1 through 14.1.2 GitLab CE/EE version 14.0.7 GitLab CE/EE version 13.12.9 Description: The issue is related to a lack of proper output encoding or escaping in GitLab, a platform for collaborative code development. Und...

Charity Management System CMS 1.0 - Multiple Vulnerabilities

Exploit Title: Charity Management System CMS 1.0 - Multiple Vulnerabilities Date: 18/08/2021 Exploit Author: Davide 't0rt3ll1n0' Taraschi Vendor Homepage: https://www.sourcecodester.com/users/tips23 Software Link:...

The vulnerability of the Fortinet FortiPortal security analysis and management tool, which stems from the rigid encoding of registration data, allows attackers to execute arbitrary commands.

The vulnerability of the Fortinet FortiPortal security analysis and management tool is related to the rigid encoding of registration data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

CVE-2021-39131

ced detects character encoding using Google’s compactencdet library. In ced v0.1.0, passing data types other than Buffer causes the Node.js process to crash. The problem has been patched in ced v1.0.0. As a workaround, before passing an argument to ced, verify it’s a Buffer using Buffer.isBuffero...

CVE-2021-39131

ced detects character encoding using Google’s compactencdet library. In ced v0.1.0, passing data types other than Buffer causes the Node.js process to crash. The problem has been patched in ced v1.0.0. As a workaround, before passing an argument to ced, verify it’s a Buffer using Buffer.isBuffero...

CVE-2021-39131

ced detects character encoding using Google’s compactencdet library. In ced v0.1.0, passing data types other than Buffer causes the Node.js process to crash. The problem has been patched in ced v1.0.0. As a workaround, before passing an argument to ced, verify it’s a Buffer using Buffer.isBuffero...

Design/Logic Flaw

ced detects character encoding using Google’s compactencdet library. In ced v0.1.0, passing data types other than Buffer causes the Node.js process to crash. The problem has been patched in ced v1.0.0. As a workaround, before passing an argument to ced, verify it’s a Buffer using...

CVE-2021-39131

CVE-2021-39131 affects the ced JavaScript library used for character encoding detection. In ced v0.1.0, passing data types other than Buffer to ced crashes the Node.js process; this is the root cause. The issue is fixed in ced v1.0.0, with a recommended workaround: verify input is a Buffer (Buffe...