PT-2022-23611 · Eclipse +1 · Eclipse Openj9 +1

Name of the Vulnerable Software and Affected Versions: Eclipse Openj9 versions prior to 0.35.0 Description: The issue allows malicious bytecode to potentially access or modify memory via an incompatible type due to the inlining of interface calls without a runtime type check. Recommendations: For...

USE OF SOLIDITY VERSION 0.8.14 WHICH HAS KNOWN ISSUES APPLICABLE TO Blur Exchange

Lines of code Vulnerability details Vulnerability details Vulnerability related to ‘Optimizer Bug Regarding Memory Side Effects of Inline Assembly’ ref : Blur Exchange inherits solidity contracts from openzeppelin and these uses inline assembly, and optimization is enabled while compiling...

Using non cleaned up variables inside of inline assembly

Lines of code Vulnerability details Impact There is a revealGobblers function in a ArtGobblers smart contract. Inside the function is an assembly insert, which operates with a variable with a size less than a machine word. But the code inside the assembly not checking that variable is cleaned up...

DRUPAL-CONTRIB-2022-054

The Next.js module provides an inline preview for content. Authenticated requests are made to Drupal to fetch JSON:API content and render them in an iframe from the decoupled Next.js site. The current implementation doesn’t sufficiently check access for fetching data. All requests made to Drupal...

Griefing attacks on NounsAuctionHouse

Lines of code Vulnerability details Impact There is internal function safeTransferETH that is called in createBid. The function itself: function safeTransferETHaddress to, uint256 value internal returns bool bool success, = to.call value: value, gas: 30000 new bytes0; return success; Please note...

Alt-N MDaemon 跨站脚本漏洞

Alt-N MDaemon is a mail service system from Alt-N, which provides complete mail server functionality, protects users from spam, enables web login to send and receive emails, supports remote management, and protects the system against email viruses when used in conjunction with the MDaemon AntiVir...

JPEGDEC 安全漏洞

JPEGDEC is a JPEG decoder optimized for Arduino by the individual developer Larry Bank. JPEGDEC has a security vulnerability that stems from a floating point exception in the DecodeJPEG module of the /src/jpeg.inl file...

nriv-inline-skaterhockey.de Cross Site Scripting vulnerability OBB-2825116

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

In mistune through 2.0.2 support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking.

...

GHSA-FW3V-X4F2-V673 Mistune vulnerable to catastrophic backtracking

In Mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking...

DEBIAN-CVE-2022-34749

In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking...

CVE-2022-34749

In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking...

UBUNTU-CVE-2022-34749

In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking...

PYSEC-2022-237

In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking...

PYSEC-2022-237

In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking...

CVE-2022-34749

In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking...

Code injection

In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking...

CVE-2022-34749

In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking...

PT-2022-22315 · Mistune +1 · Mistune +1

Name of the Vulnerable Software and Affected Versions: Mistune versions 2.0.2 and earlier Description: The issue arises from the support of inline markup in Mistune, which utilizes regular expressions. These regular expressions can lead to a high amount of backtracking on certain edge cases, a...

mistune 安全漏洞

mistune is a fast and powerful Python Markdown parser from the individual developer Hsiaoming Yang. A security vulnerability exists in mistune 2.0.2 and earlier versions, which stems from the fact that its support for inline markup is implemented through the use of regular expressions, which may...