OS Command Injection in jw.util

An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safeload is not used...

GHSA-H72C-W3Q3-55QQ OS Command Injection in jw.util

An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safeload is not used...

PYSEC-2021-92

An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load...

CVE-2021-32647

Emissary is a P2P based data-driven workflow engine. Affected versions of Emissary are vulnerable to post-authentication Remote Code Execution RCE. The CreatePlace REST endpoint accepts an sppClassName parameter which is used to load an arbitrary class. This class is later instantiated using a...

The installers of ScanSnap Manager may insecurely load Dynamic Link Libraries

Overview The installers of ScanSnap Manager provided by FUJITSU LIMITED contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Yuji Tounai of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated wi...

Installer of Overwolf may insecurely load Dynamic Link Libraries

Overview Overwolf is a software framework for creating applications for games. The Overwolf Installer contains an issue with the DLL search path CWE-427, which may lead to insecurely loading Dynamic Link Libraries stored in the same directory where the installer resides. Shogo kumamaru of LAC Co....

Overwolf 代码问题漏洞

Overwolf is a framework from the Israeli company Overwolf that supports building games using HTML and JavaScript. Overwolf Installer 2.168.0 suffers from a code issue vulnerability that stems from the application loading DLL libraries in an insecure manner. A remote attacker could exploit the...

CVE-2021-3423

Uncontrolled Search Path Element vulnerability in the openssl component as used in Bitdefender GravityZone Business Security allows an attacker to load a third party DLL to elevate privileges. This issue affects Bitdefender GravityZone Business Security versions prior to 6.6.23.329...

CVE-2021-3423

CVE-2021-3423 describes an uncontrolled search path element issue in the OpenSSL usage within Bitdefender GravityZone Business Security that enables local privilege escalation by loading a third-party DLL. Affected versions are GravityZone Business Security prior to 6.6.23.329. The root cause is ...

@applicaster/zapp-react-native-fast-image (>=1.0.0, <=1.1.0-beta.0), @momo-platform/component-kits (1.1.74) +5 more potentially affected by CVE-2020-7696 via react-native-fast-image (>=8.1.2, <=8.2.0)

react-native-fast-image NPM version =8.1.2, =1.0.0, =0.0.1, =0.1.0, =1.2.23 Source cves: CVE-2020-7696 Source advisory: OSV:GHSA-6XHG-Q9C8-RJ32...

CVE-2021-3423: Uncontrolled Search Path Element

Uncontrolled Search Path Element vulnerability in the openssl component as used in Bitdefender GravityZone Business Security allows an attacker to load a third party DLL to elevate privileges. This issue affects Bitdefender GravityZone Business Security versions prior to 6.6.23.329...

GHSA-6VQP-H455-42MR Uncontrolled Memory Allocation in Apache PDFBox

A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions...

Adobe Genuine Service Code Issue Vulnerability

Adobe Genuine Service is a licensed software service from Adobe. A security vulnerability exists in Adobe Genuine Service 6.6 and earlier versions based on Window and macOS platforms, which stems from the program not loading libraries correctly. An attacker could exploit the vulnerability to...

gdk-pixbuf:pixbuf_scale_fuzzer: Heap-buffer-overflow in g_base64_encode_step

Project: https://gitlab.gnome.org/GNOME/gdk-pixbuf.git Detailed Report: https://oss-fuzz.com/testcase?key=5558597388992512 Project: gdk-pixbuf Fuzzing Engine: libFuzzer Fuzz Target: pixbufscalefuzzer Job Type: libfuzzerasangdk-pixbuf Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Cras...

NewStart CGSL CORE 5.04 / MAIN 5.04 : thunderbird Multiple Vulnerabilities (NS-SA-2021-0025)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has thunderbird packages installed that are affected by multiple vulnerabilities: - In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free conditio...

DEBIAN-CVE-2021-32062

MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enforce the MSMAPNOPATH and MSMAPPATTERN restrictions that are intended to control the locations from which a mapfile may be loaded with MapServer CGI...

Design/Logic Flaw

MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enforce the MSMAPNOPATH and MSMAPPATTERN restrictions that are intended to control the locations from which a mapfile may be loaded with MapServer CGI...

CVE-2021-32062

MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enforce the MSMAPNOPATH and MSMAPPATTERN restrictions that are intended to control the locations from which a mapfile may be loaded with MapServer CGI...

CVE-2021-32062

MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enforce the MSMAPNOPATH and MSMAPPATTERN restrictions that are intended to control the locations from which a mapfile may be loaded with MapServer CGI...

CVE-2021-31231

The Alertmanager in Grafana Enterprise Metrics before 1.2.1 and Metrics Enterprise 1.2.1 has a local file disclosure vulnerability when experimental.alertmanager.enable-api is used. The HTTP basic auth passwordfile can be used as an attack vector to send any file content via a webhook. The...