2077 matches found
Contao Insert tag injection in forms
Impact It is possible to inject insert tags in front end forms which will be replaced when the page is rendered. Patches Update to Contao 4.4.52, 4.9.6 or 4.10.1. Workarounds Disable the front end login form and do not use form fields with array keys such as fieldname. References...
GHSA-F7WM-X4GW-6M23 Contao Insert tag injection in forms
Impact It is possible to inject insert tags in front end forms which will be replaced when the page is rendered. Patches Update to Contao 4.4.52, 4.9.6 or 4.10.1. Workarounds Disable the front end login form and do not use form fields with array keys such as fieldname. References...
Missing check in ArrayVec leads to out-of-bounds write.
ArrayVec::insert allows insertion of an element into the array object into the specified index. Due to a missing check on the upperbound of this index, it is possible to write out of bounds...
RUSTSEC-2020-0042 Missing check in ArrayVec leads to out-of-bounds write.
ArrayVec::insert allows insertion of an element into the array object into the specified index. Due to a missing check on the upperbound of this index, it is possible to write out of bounds...
PT-2020-17527 · Rust · Stack Crate
Name of the Vulnerable Software and Affected Versions: stack crate versions prior to 0.3.1 Description: The issue is related to the ArrayVec in the stack crate, where the insert method allows insertion of an element into the array object at a specified index. Due to a missing check on the upper...
PT-2020-16192
Name of the Vulnerable Software and Affected Versions Contao versions 4.4.0 through 4.4.51 Contao versions 4.9.0 through 4.9.5 Contao versions 4.10.0 through 4.10.0 Description The issue is related to Improper Input Validation, allowing the injection of insert tags in front end forms. These tags...
DEBIAN-CVE-2020-25795
An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, insertfrom can have a memory-safety issue upon a panic...
UBUNTU-CVE-2020-25795
An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, insertfrom can have a memory-safety issue upon a panic...
nginx:http_request_fuzzer: Stack-use-after-return in ngx_rbtree_insert_timer_value
Detailed Report: https://oss-fuzz.com/testcase?key=5092575764283392 Project: nginx Fuzzing Engine: libFuzzer Fuzz Target: httprequestfuzzer Job Type: libfuzzerasannginx Platform Id: linux Crash Type: Stack-use-after-return READ 8 Crash Address: 0x7f0bfc089ae8 Crash State: ngxrbtreeinserttimervalu...
PT-2020-16214
Name of the Vulnerable Software and Affected Versions sized-chunks crate versions through 0.6.2 Description An issue was discovered in the sized-chunks crate, where the Chunk implementation has memory-safety issues. Specifically, the array size is not checked when constructed with unit, pair, or...
PT-2020-16213
Name of the Vulnerable Software and Affected Versions sized-chunks crate versions through 0.6.2 Description The issue concerns memory safety in the sized-chunks crate for Rust. Specifically, in the Chunk implementation, the array size is not checked when constructed with From, unit, or pair...
PT-2020-16212
Name of the Vulnerable Software and Affected Versions sized-chunks crate versions through 0.6.2 Description An issue was discovered in the sized-chunks crate, where the array size is not checked when constructed with unit and pair in the Chunk implementation. Additionally, the array size is not...
PT-2020-16211
Name of the Vulnerable Software and Affected Versions sized-chunks crate versions through 0.6.2 Description An issue was discovered in the sized-chunks crate, where the array size is not checked when constructed with unit, pair, or From in the Chunk implementation. Additionally, the Clone and...
Prototype Pollution
promisehelpers is vulnerable to prototype pollution. The vulnerability exists as the insert function does not restrict proto headers to be set in objects...
CVE-2020-7723
All versions of package promisehelpers are vulnerable to Prototype Pollution via the insert function...
Code injection
All versions of package promisehelpers are vulnerable to Prototype Pollution via the insert function...
CVE-2020-7723
All versions of package promisehelpers are vulnerable to Prototype Pollution via the insert function...
CVE-2020-7723 Prototype Pollution
All versions of package promisehelpers are vulnerable to Prototype Pollution via the insert function...
CVE-2020-7723
CVE-2020-7723 affects the JavaScript package promisehelpers. All versions prior to 0.0.6 are vulnerable to prototype pollution via the insert function, enabling an attacker to inject properties into Object.prototype (e.g., through proto ). Documented impacts include potential denial of service an...
