105 matches found
GHSA-C2HM-MJXV-89R4 Multiple soundness issues in lexical
lexical contains multiple soundness issues: 1. Bytes::read allows creating instances of types with invalid bit patterns 1. BytesIter::read advances iterators out of bounds 1. The BytesIter trait has safety invariants but is public and not marked unsafe 1. writefloat calls MaybeUninit::assumeinit ...
Multiple soundness issues in lexical
lexical contains multiple soundness issues: 1. Bytes::read allows creating instances of types with invalid bit patterns 1. BytesIter::read advances iterators out of bounds 1. The BytesIter trait has safety invariants but is public and not marked unsafe 1. writefloat calls MaybeUninit::assumeinit ...
BrandoCulqi (=1.0.1), IMAPServer (=0.1.0) +2299 more potentially affected by unknown CVE via lexical-core (>=0.1.3 <=0.8.5)
lexical-core CARGO version =0.1.3, =1.0.0, =1.0.1, =0.10.0-dev0, =0.2.0, =0.1.0, =0.2.0, =0.1.1, =0.5.1, =0.1.0, =0.1.0, =0.2.0, =0.3.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0086...
IMAPServer (=0.1.0), actson (>=0.2.0 <=0.3.0) +473 more potentially affected by unknown CVE via lexical (>=2.2.4 <=6.1.1)
lexical CARGO version =2.2.4, =0.2.0, =0.1.0, =0.8.0, =0.1.0, =0.11.0, =0.2.0, =0.1.0, =0.6.0, =0.6.0, =0.6.0, =0.4.0, =0.6.0, =0.15.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0055...
RUSTSEC-2023-0055 Multiple soundness issues
lexical contains multiple soundness issues: 1. Bytes::read allows creating instances of types with invalid bit patterns 1. BytesIter::read advances iterators out of bounds 1. The BytesIter trait has safety invariants but is public and not marked unsafe 1. writefloat calls MaybeUninit::assumeinit ...
CVE-2023-30792
Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where input was being parsed from untrusted sources...
CVE-2023-30792
Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where input was being parsed from untrusted sources...
CVE-2023-30792
The CVE-2023-30792 issue affects Meta Platforms Lexical versions prior to 0.10.0, where anchor tag hrefs render javascript: URLs when parsing input from untrusted sources, enabling cross-site scripting on link clicks. The vulnerability stems from unsanitized hrefs in anchor elements (createDOM pa...
Meta Platforms Lexical 跨站脚本漏洞
Meta Platforms Lexical is an extensible JavaScript web text editor framework from Meta Platforms, Inc. A security vulnerability exists in Meta Platforms Lexical versions prior to v0.10.0 that originates from allowing cross-site scripting attacks on link clicks while parsing input from an untruste...
PT-2023-22985 · Lexical · Lexical
Name of the Vulnerable Software and Affected Versions: Lexical versions prior to 0.10.0 Description: The issue allows cross-site scripting on link clicks when input is being parsed from untrusted sources, due to href attributes in anchor tags rendering javascript: URLs. Recommendations: For...
PicoC 缓冲区错误漏洞
PicoC is a lightweight C interpreter. A buffer error vulnerability exists in PicoC version 3.2.2, which stems from a heap buffer overflow contained in the LexSkipComment function in lex.c when LexScanGetToken is called...
The vulnerability of the sql_lex.cc component of the MariaDB database, which allows a hacker to cause a service failure.
The vulnerability of the sqllex.cc component of the MariaDB database is related to integer overflow. Exploiting this vulnerability allows an attacker to cause service failures...
[SECURITY] Fedora 35 Update: golang-starlark-0-0.7.20210113gite81fc95.fc35
Starlark is a dialect of Python intended for use as a configuration language. Like Python, it is an untyped dynamic language with high-level data types, first-class functions with lexical scope, and garbage collection. Unlike CPython, independent Starlark threads execute in parallel, so Starlark...
Malicious Package
Overview lexical-website-new is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packa...
MAL-2022-4290 Malicious code in lexical-monorepo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4af686331feed45b8818ceff08372677fb1f0f5531b48057d994aa8d3e871fc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in lexical-monorepo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4af686331feed45b8818ceff08372677fb1f0f5531b48057d994aa8d3e871fc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in lexical-website-new (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware edf8272d90444a72cfac6b1d5fad7cca728ef7be68d666235965897dd316f5f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2021-46338
There is an Assertion 'ecmaislexicalenvironment objectp' failed at /base/ecma-helpers.cecmagetlexenvtype in JerryScript 3.0.0...