jquery-ui: XSS in *Text options of the datepicker widget

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various Text options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various Text options are now alway...

Path Traversal

github.com/hashicorp/go-getter is vulnerable to path traversal. An attacker can access files outside the expected directory and download files or directories from various sources using malicious URLs by providing malicious inputs...

EulerOS 2.0 SP3 : yajl (EulerOS-SA-2022-1776)

According to the versions of the yajl package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of yajl contain an integer overflow whi...

USN-4781-1: Slurm vulnerabilities

It was discovered that Slurm incorrectly handled certain messages between the daemon and the user. An attacker could possibly use this issue to assume control of an arbitrary file on the system. This issue only affected Ubuntu 16.04 ESM. CVE-2016-10030 It was discovered that Slurm mishandled SPAN...

USN-4781-1 slurm-llnl vulnerabilities

It was discovered that Slurm incorrectly handled certain messages between the daemon and the user. An attacker could possibly use this issue to assume control of an arbitrary file on the system. This issue only affected Ubuntu 16.04 ESM. CVE-2016-10030 It was discovered that Slurm mishandled SPAN...

GHSA-87X7-PWRX-JCH7 Liferay Portal and Liferay DXP Reveals Data via Overly Verbose Error Messages

The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused...

GHSA-XHFX-RM8Q-C3XV Moodle Vulnerable to Reflected Cross-site Scripting

It was found in Moodle before version 4.0.0-beta that some search inputs were vulnerable to reflected Cross-site Scripting XSS due to insufficient escaping of search queries...

Improper Neutralization of Input During Web Page Generation in CKEditor4

A cross-site scripting XSS vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of editor inputs...

Cross-site Scripting (XSS)

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the pattern attribute in form inputs. An attacker can inject HTML or execute arbitrary JavaScript by crafting malicious input that exploits improper escaping of thi...

USN-5437-1: libXfixes vulnerability

Tobias Stoeckmann discovered that libXfixes incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code...

CVE-2018-17937

gpsd versions 2.90 to 3.17 and microjson versions 1.0 to 1.3, an open source project, allow a stack-based buffer overflow, which may allow remote attackers to execute arbitrary code on embedded platforms via traffic on Port 2947/TCP or crafted JSON inputs...

CVE-2022-29181

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors segfault or reads from unrelated memory. Version 1.13.6...

CLSA-2022-1652987360 Fixed CVE-2018-25032 in rsync

CVE-2018-25032: zlib: A flaw found in zlib when compressing not decompressing certain inputs...

Denial Of Service (DoS)

ruby-nokogiri is vulnerable to denial of service. The vulnerability exists due to a segfault allowing an attacker to crash the system with a specially crafted untrusted inputs...

GO-2022-0273 Panic due to crafted inputs in archive/zip

The NewReader and OpenReader functions in archive/zip can cause a panic or an unrecoverable fatal error when reading an archive that claims to contain a large number of files, regardless of its actual size. This is caused by an incomplete fix for CVE-2021-33196...

smallrye-health-ui: persistent cross-site scripting in endpoint

It was found that the smallrye health metrics UI component did not properly sanitize some user inputs. An attacker could use this flaw to conduct cross-site scripting attacks...

zlib: A flaw found in zlib when compressing (not decompressing) certain inputs

An out-of-bounds access flaw was found in zlib, which allows memory corruption when deflating ex: when compressing if the input has many distant matches. For some rare inputs with a large number of distant matches crafted payloads, the buffer into which the compressed or deflated data is written...

PT-2022-10229 · Unknown +1 · Watsonwebserver +1

Name of the Vulnerable Software and Affected Versions: WatsonWebserver versions 4.1.3 and below IpMatcher versions 1.0.4.1 and below Description: An Input Validation issue exists due to insufficient validation of input IP addresses and netmasks against the internal Matcher list of IP addresses an...

GHSA-4Q2W-RW7M-XQW6 Sony Neural Network Libraries reliance on untrusted inputs prior to v1.0.10

nbla/logger.cpp in libnnabla.a in Sony Neural Network Libraries aka nnabla prior to v1.0.10 relies on the HOME environment variable, which might be untrusted...

Sony Neural Network Libraries reliance on untrusted inputs prior to v1.0.10

nbla/logger.cpp in libnnabla.a in Sony Neural Network Libraries aka nnabla prior to v1.0.10 relies on the HOME environment variable, which might be untrusted...