7519 matches found
vm2 before 3.6.11 vulnerable to sandbox escape
This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code runnin...
CVE-2022-32117
Jerryscript v2.4.0 was discovered to contain a stack buffer overflow via the function jerryxprintunhandledexception in /util/print.c...
CVE-2022-32117
Jerryscript v2.4.0 was discovered to contain a stack buffer overflow via the function jerryxprintunhandledexception in /util/print.c...
CVE-2019-10761
This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code runnin...
CVE-2019-10761
This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code runnin...
Code injection
This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code runnin...
CVE-2019-10761 Sandbox Bypass
This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code runnin...
JerryScript 缓冲区错误漏洞
JerryScript is a lightweight JavaScript engine from the Jerryscript project. A security vulnerability exists in JerryScript version v2.4.0, which originates from a stack buffer overflow via the function jerryxprintunhandledexception in /util/print.c. The vulnerability is caused by the function...
Valinor error messages leading to potential data exfiltration before v0.12.0
php registerConstructorMoney::class, 'fromString' -mapper; try vardump$mapper-mapFoo::class, 'a' = 'HAHA', 'b' = '100 EUR', 'c' = 'USD 100' ; catch MappingError $e $messages = new NodeTraverserfunction Node $node foreach $node-messages as $message vardump '$message', $message-path, $message-body ...
GHSA-5PGM-3J3G-2RC7 Valinor error messages leading to potential data exfiltration before v0.12.0
php registerConstructorMoney::class, 'fromString' -mapper; try vardump$mapper-mapFoo::class, 'a' = 'HAHA', 'b' = '100 EUR', 'c' = 'USD 100' ; catch MappingError $e $messages = new NodeTraverserfunction Node $node foreach $node-messages as $message vardump '$message', $message-path, $message-body ...
CVE-2022-31140
Valinor is a PHP library that helps to map any input into a strongly-typed value object structure. Prior to version 0.12.0, Valinor can use ThrowablegetMessage when it should not have permission to do so. This is a problem with cases such as an SQL exception showing an SQL snippet, a database...
The vulnerabilities of the microprogramming software for the Desigo DXR2, PXC3, PXC4, and PXC5 station modules allow a intruder to cause service failures.
The vulnerability of the microprogramming software for the Desigo DXR2, PXC3, PXC4, and PXC5 stations is related to an exception handling error. Exploiting this vulnerability could allow a perpetrator to cause service failures by installing a key derived from PBKDF2...
The vulnerability of the BACnet protocol implementation in the micro-programming software for Desigo DXR2, PXC3, PXC4, and PXC5 modules allows a intruder to trigger a service failure.
The vulnerability of the BACnet protocol implementation in the micro-programming software for Desigo DXR2, PXC3, PXC4, and PXC5 modules is related to an exception handling error. Exploiting this vulnerability can allow attackers to cause service failures...
Huawei MindSpore Community numeric error vulnerability
Huawei MindSpore Community is an open source deep learning framework from Huawei China.A numerical error vulnerability exists in versions prior to Huawei MindSpore Community 1.3.0, which stems from the fact that when performing the initialization operation of the Split operator, if a dimension in...
PT-2022-22329 · Jenkins · Jenkins Testng Results Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins TestNG Results Plugin versions 554.va4a552116332 and earlier Description: The issue is related to a cross-site scripting XSS vulnerability. It occurs when the Jenkins TestNG Results Plugin renders unescaped test descriptions and...
CVE-2021-33654
When performing the initialization operation of the Split operator, if a dimension in the input shape is 0, it will cause a division by 0 exception...
CVE-2021-33651
When performing the analytical operation of the DepthwiseConv2D operator, if the attribute depthmultiplier is 0, it will cause a division by 0 exception...
CVE-2021-33653
When performing the derivation shape operation of the SpaceToBatch operator, if there is a value of 0 in the parameter blockshape element, it will cause a division by 0 exception...