11932 matches found
Malicious code in pfa-errors (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e06752c5f827cccdf98f23fa26d893d44e2889b8b7011e8fdb130524f09fe0f On require'pfa-errors', index.js unconditionally loads runtime.js, which fetches a platform-specific opaque binary from one of three hardcoded...
EUVD-2026-53375
Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers...
The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.
The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge is related to errors in handling HTTP requests. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...
The vulnerability of the Skia component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.
The vulnerability of the Skia component in Google Chrome and Microsoft Edge is related to errors in HTTP request processing. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...
The vulnerability of the Skia component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.
The vulnerability of the Skia component in Google Chrome and Microsoft Edge is related to errors in HTTP request processing. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...
cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing
Summarypkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported theoutcome of decrypting a RecipientInfo's encryptedKey in severaldistinguishable ways, one of which disclosed the exact length recovered from theRSA operation. The same distinction was also observable by timing. Anapplicatio...
PYSEC-2026-3552 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing
Summary pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An...
EUVD-2026-52446
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which...
CVE-2026-66296
The CVE-2026-66296 issue concerns oaskit: a reflected XSS vulnerability in the default HTML error handler. The root cause is that Oaskit.ErrorHandler.Default.format_reason/4 and Oaskit.ErrorHandler.Default.reason_to_html/1 render request-validation failures as HTML when the Accept header includes...
EUVD-2026-52407
Improper Neutralization of Input During Web Page Generation XSS vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler. Oaskit.ErrorHandler.Default.formatreason/4 and Oaskit.ErrorHandler.Default.reasontohtml/1 in lib/oaskit/errorhandler/default.ex...
net/textproto: golang: Golang net/textproto: Misleading error messages via input injection
A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead...
CVE-2026-69092 Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint
Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response. Unauthenticated attackers can inject arbitrary JavaScript through SAML Issuer elements or LightSaml library parameters to...
The vulnerability of the Downloads component in the Google Chrome browser allows attackers to perform spear-phishing attacks.
The vulnerability of the Downloads component in the Google Chrome browser is related to information representation errors in the user interface. Exploiting this vulnerability can allow a remote attacker to perform spear-phishing attacks...
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to execute arbitrary code.
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to type mixing errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to execute arbitrary code.
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to type mixing errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of Google Chrome’s fullscreen mode allows attackers to carry out spoofing attacks.
The vulnerability of Google Chrome’s fullscreen mode is related to information representation errors in the user interface. Exploiting this vulnerability can allow a remote attacker to perform spoofing attacks...
The vulnerability of the XML component of the Google Chrome browser, allowing a hacker to execute arbitrary code.
The vulnerability of the Google Chrome XML browser component is related to errors in handling http requests. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2026-56568
HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes internal endpoint names, request parameters, error codes, and...
The vulnerability of the qs.stringify() function in the string query analysis and transformation library allows a attacker to cause a service failure.
The vulnerability of the qs.stringify function in the string query analysis and conversion library is related to pointer arithmetic errors. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...
The vulnerability of Google Chrome’s Payments component, which allows a violator to trigger a service failure.
The vulnerability of Google Chrome’s Payments component is related to synchronization errors when using a common resource. Exploiting this vulnerability can allow an attacker to cause a service failure...