CVE-2021-3403: Use After Free

In ytnef 1.9.3, the TNEFSubjectHandler function in lib/ytnef.c allows remote attackers to cause a denial-of-service and potentially code execution due to a double free which can be triggered via a crafted file...

openSUSE Security Update : nghttp2 (openSUSE-2021-341)

This update for nghttp2 fixes the following issues : nghttp2 was update to version 1.40.0 bsc1166481 - lib: Add nghttp2checkauthority as public API - lib: Fix the bug that stream is closed with wrong error code - lib: Faster huffman encoding and decoding - build: Avoid filename collision of stati...

Security update for nghttp2 (moderate)

openSUSE Security Update: Security update for nghttp2 Announcement ID: openSUSE-SU-2021:0341-1 Rating: moderate References: 1159003 1166481 Cross-References: CVE-2019-18802 CVSS scores: CVE-2019-18802 NVD : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-18802 SUSE: 7.5...

PT-2021-11531

Name of the Vulnerable Software and Affected Versions: theme-core versions affected versions not specified Description: The issue concerns command injection via the lib/utils.js file in the theme-core package. This file is required by the main entry of the package. Technical details include the u...

CVE-2021-27228

An issue was discovered in Shinobi through ocean version 1. lib/auth.js has Incorrect Access Control. Valid API Keys are held in an internal JS Object. Therefore an attacker can use JS Proto Method names such as constructor or hasOwnProperty to convince the System that the supplied API Key exists...

PT-2021-17335

Name of the Vulnerable Software and Affected Versions: Shinobi through ocean version 1 Description: An issue was discovered in the lib/auth.js file, where Incorrect Access Control allows attackers to bypass API key validation. By utilizing JavaScript Proto Method names, such as constructor or...

CVE-2021-27228: Use of Hard-coded Credentials

An issue was discovered in Shinobi through ocean version 1. lib/auth.js has Incorrect Access Control. Valid API Keys are held in an internal JS Object. Therefore an attacker can use JS Proto Method names such as constructor or hasOwnProperty to convince the System that the supplied API Key exists...

CVE-2020-24617

Mailtrain through 1.24.1 allows SQL Injection in statsClickedSubscribersByColumn in lib/models/campaigns.js via /campaigns/clicked/ajax because variable column names are not properly escaped...

CVE-2020-24617

Mailtrain through 1.24.1 allows SQL Injection in statsClickedSubscribersByColumn in lib/models/campaigns.js via /campaigns/clicked/ajax because variable column names are not properly escaped...

PT-2021-11048

Name of the Vulnerable Software and Affected Versions: Mailtrain versions 1.24.1 and earlier Description: The issue allows SQL Injection in the statsClickedSubscribersByColumn function in lib/models/campaigns.js via the "/campaigns/clicked/ajax" API endpoint because variable column names are not...

CVE-2020-24617: Improper Neutralization of Special Elements used in an SQL Command

Mailtrain through 1.24.1 allows SQL Injection in statsClickedSubscribersByColumn in lib/models/campaigns.js via /campaigns/clicked/ajax because variable column names are not properly escaped...

The vulnerability in the implementations of the IPv4Interface and IPv6Interface classes in the Lib/ipaddress.py module of the Python programming language allows a attacker to cause a service failure.

The vulnerability of the IPv4Interface and IPv6Interface classes in the Lib/ipaddress.py module of the Python programming language involves an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

The vulnerability of the _proc_pax function (Lib/tarfile.py) in the Python programming language allows a attacker to cause a service failure.

The vulnerability of the procpax function in the Lib/tarfile.py module of the Python interpreter is related to insufficient input validation. Exploiting this vulnerability could allow an attacker to cause service failures remotely...

CVE-2020-7785

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

Code injection

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

CVE-2020-7782

This affects all versions of package spritesheet-js. It depends on a vulnerable package platform-command. The injection point is located in line 32 in lib/generator.js, which is triggered by main entry of the package...

CVE-2020-7785

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

CVE-2020-7785 Command Injection

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

CVE-2020-7785

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

CVE-2021-21304

Dynamoose is an open-source modeling tool for Amazon's DynamoDB. In Dynamoose from version 2.0.0 and before version 2.7.0 there was a prototype pollution vulnerability in the internal utility method "lib/utils/object/set.ts". This method is used throughout the codebase for various operations...