1215 matches found
CVE-2021-28092
The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service ReDoS. If an attacker provides a malicious string, is-svg will get stuck processing the input for a very long time...
Design/Logic Flaw
The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service ReDoS. If an attacker provides a malicious string, is-svg will get stuck processing the input for a very long time...
CVE-2021-28092
CVE-2021-28092 affects the is-svg npm package for Node.js (versions 2.1.0–4.2.1), where a regex-based ReDoS can cause input processing to stall, leading to a potential denial of service. In CP4S context, remediation guidance available: upgrade Cloud Pak for Security to version 1.9.0 or later. Evi...
Sindre Sorhus is-svg 安全漏洞
Sindre Sorhus is-svg is Sindre Sorhus an open source application. Provides a string or buffer to check whether the SVG function . A security vulnerability exists in is-svg package 2.1.0 through 4.2.1, which can be exploited by an attacker to supply a malicious string, causing is-svg to be unable ...
PT-2021-17738 · Npm · Is-Svg
Name of the Vulnerable Software and Affected Versions: is-svg package versions 2.1.0 through 4.2.1 Description: The issue concerns a Regular Expression Denial of Service ReDoS vulnerability in the is-svg package for Node.js. If an attacker provides a malicious string, the package will get stuck...
Denial Of Service (DoS)
privoxy is vulnerable to denial of service DoS. The vulnerability exists through the chunkedbodyiscomplete where an invalid read of size two can occur...
Lightweight Directory Access Protocol (LDAP) Injection
is-user-valid is vulnerable to Lightweight Directory Access Protocol LDAP Injection. The vulnerability exists due to an unsanitized validate function when authenticating the email in the getEmail function...
CVE-2021-23335 LDAP Injection
All versions of package is-user-valid are vulnerable to LDAP Injection which can lead to either authentication bypass or information exposure...
Why Data Privacy Day matters
Our Lock and Code special episode on Data Privacy Day, featuring guests from Mozilla, DuckDuckGo, and Electronic Frontier Foundation can be listened to here. Today, January 28, is Data Privacy Day, the annual, multinational event in which governments, companies, and schools can inform the public...
RUSTSEC-2020-0119 ReadTicket and WriteTicket should only be sendable when T is Send
Affected versions of this crate unconditionally implemented Send for ReadTicket & WriteTicket. This allows to send non-Send T to other threads. This can allows creating data races by cloning types with internal mutability and sending them to other threads as T of ReadTicket/WriteTicket. Such data...
sportsiskorea.com Cross Site Scripting vulnerability OBB-1483261
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
DEBIAN-CVE-2020-28037
isbloginstalled in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution as well as a denial of service for the old installation...
Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPS
An HTTP detection flaw was discovered in Django. If deployed behind a reverse-proxy connecting to Django via HTTPS, django.http.HttpRequest.scheme incorrectly detected client requests made using HTTP as using HTTPS. This resulted in incorrect results for issecure and buildabsoluteuri, and HTTP...
council82.org Cross Site Scripting vulnerability OBB-1456052
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPS
An HTTP detection flaw was discovered in Django. If deployed behind a reverse-proxy connecting to Django via HTTPS, django.http.HttpRequest.scheme incorrectly detected client requests made using HTTP as using HTTPS. This resulted in incorrect results for issecure and buildabsoluteuri, and HTTP...
CVE-2020-15897
Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause traffic loss or incorrect forwarding of traffic via a malformed link-state PDU to the IS-IS router...
Code injection
Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause traffic loss or incorrect forwarding of traffic via a malformed link-state PDU to the IS-IS router...
CVE-2020-15897
CVE-2020-15897 affects Arista EOS where malformed IS-IS link-state PDUs can cause traffic loss or incorrect forwarding. Affected EOS versions are 4.21.12M and all 4.22.x prior to 4.22.7M, all 4.23.x prior to 4.23.5M, and all 4.24.x prior to 4.24.2F. The issue arises in the IS-IS router when proce...
planmedi.com Cross Site Scripting vulnerability OBB-1446867
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
diskmoe.com Cross Site Scripting vulnerability OBB-1414911
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...