nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes

A regular expression denial of service ReDoS vulnerability was found in nodejs-ansi-regex. This could possibly cause an application using ansi-regex to use an excessive amount of CPU time when matching crafted ANSI escape codes...

Cross-site Scripting (XSS)

jetspeed-portal is vulnerable to cross-site scripting. The vulnerability exists because the library does not properly filter the untrusted user inputs by default, allowing an attacker to inject and execute malicious javascript...

Denial Of Service

Open policy agent is vulnerable to Denial of Service. An attacker is able to crash the system via a maliciously crafted inputs via the abstract systax tree parser in ast/compile.go...

SUSE-SU-2022:2314-1 Security update for rsyslog

This update for rsyslog fixes the following issues: - CVE-2022-24903: fix potential heap buffer overflow in modules for TCP syslog reception bsc1199061 Upgrade to rsyslog 8.2106.0 bsc1188039 NOTE: the prime new feature is support for TLS and non-TLS connections via imtcp in parallel. Furthermore,...

PT-2022-20550

Name of the Vulnerable Software and Affected Versions moment versions prior to 2.29.4 Description The issue is related to an inefficient parsing algorithm used in the moment JavaScript date library, specifically in the string-to-date parsing and rfc2822 parsing. This results in quadratic complexi...

GO-2022-0209 Insufficiently random values in golang.org/x/crypto/salsa20

XORKeyStream generates incorrect and insecure output for very large inputs. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream...

GO-2022-0197 Panic when parsing certain inputs in golang.org/x/net/html

The Parse function can panic on some invalid inputs. For example, the Parse function panics on the input ""...

GO-2022-0192 Incorrect parsing of nested templates in golang.org/x/net/html

The Parse function can panic on some invalid inputs. For example, the Parse function panics on the input ""...

GO-2021-0142 Unbounded read from invalid inputs in encoding/binary

ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs. Certain invalid inputs to ReadUvarint or ReadVarint can cause these functions to read an unlimited number of bytes from the ByteReader parameter before returning an error. This can lead to processing more input...

golang: encoding/pem: fix stack overflow in Decode

A buffer overflow flaw was found in Golang's library encoding/pem. This flaw allows an attacker to use a large PEM input more than 5 MB, causing a stack overflow in Decode, which leads to a loss of availability...

golang: regexp: stack exhaustion via a deeply nested expression

A stack overflow flaw was found in Golang's regexp module, which can crash the runtime if the application using regexp accepts very long or arbitrarily long regexps from untrusted sources that have sufficient nesting depths. To exploit this vulnerability, an attacker would need to send large...

Regular Expression Denial Of Service (ReDoS)

split-html-to-chars is vulnerable to regular expression denial of service. The vulnerability exists in Splitter function in index.js because the html inputs are not properly sanitized due to insufficient regular expression complexity applied when splitting html to letters for animation which allo...

CVE-2021-33650

When performing the inference shape operation of the SparseToDense operator, if the number of inputs is less than three, it will access data outside of bounds of inputs which allocated from heap buffers...

Miscompilation of `i8x16.swizzle` and `select` with v128 inputs

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqwc-c49r-4w2x. For more information see the GitHub-hosted security advisory...

RUSTSEC-2022-0095 Miscompilation of `i8x16.swizzle` and `select` with v128 inputs

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqwc-c49r-4w2x. For more information see the GitHub-hosted security advisory...

Cross-site Scripting (XSS)

concrete5/concrete5 is vulnerable to cross-site scripting. The vulnerability exists in the old browsers with the XSS protection is disabled, allowing an attacker to inject and execute malicious javascript as the library does not properly escape malicious inputs by default...

Denial Of Service (DoS)

fast-string-search is vulnerable to denial of service. The vulnerability exists due to incorrect computations for non-string inputs which allows an attacker to gain read access from non-permitted locations and cause an application crash...

Stack too deep error within BaseV1-periphery.sol

Lines of code BaseV1-periphery.sol lines 323-341 Vulnerability details Impact Stack too deep error when using remove liquidity function, fixing issue allows for avoiding using optimizations thus increases the periphery contract's longevity/scalability. Proof of Concept function...

ASUS Control Center SQL注入漏洞

ASUS Control Center is a new centralized IT management software from ASUS China. The software can monitor and control ASUS servers, workstations. A SQL injection vulnerability exists in ASUS Control Center v1.4.2.5. An attacker can exploit this vulnerability to inject SQL commands into specific A...

PT-2022-14124 · WordPress · Very Simple Contact Form

Name of the Vulnerable Software and Affected Versions: Very Simple Contact Form WordPress plugin versions prior to 11.6 Description: The issue allows bots to bypass the captcha check by exposing the solution in the rendered contact form as hidden input fields and plain text, making the page a...