CVE-2021-22557

SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We recommend upgrading SLO Generator past https://github.com/google/slo-generator/pull/173...

PYSEC-2021-429

SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We recommend upgrading SLO Generator past https://github.com/google/slo-generator/pull/173...

PT-2021-15141 · Google · Slo Generator

Name of the Vulnerable Software and Affected Versions: SLO Generator versions prior to the version including https://github.com/google/slo-generator/pull/173 Description: The SLO generator has an issue where it allows for the loading of YAML files. If these files are crafted in a specific format,...

PT-2021-23112 · Unknown · Pterodactyl

Name of the Vulnerable Software and Affected Versions: Pterodactyl affected versions not specified Description: A malicious user can modify the contents of a confirmation token input during the two-factor authentication process to reference a cache value not associated with the login attempt. Thi...

Slo Generator: Operating System Command Injection Vulnerability

Slo Generator is a tool. for calculating Sli, Slo, error budgets and consumption rates and exporting Slo reports to supported exporters. Slo Generator suffers from an operating system command injection vulnerability that stems from the Slo Generator allowing the loading of YAML files. An attacker...

CVE-2021-23243

In Oppo's battery application, the third-party SDK provides the function of loading a third-party Provider, which can be used...

Dell BIOS security vulnerabilities

DELL Dell BIOSConnect is an underlying platform from Dell USA that enables BIOS to connect to Dell's HTTP backend and load images via the HTTP method. Dell BIOS has a security vulnerability that stems from the authentication mechanism not being brute force protected. A local administrator can...

RSS/Atom/Pie LibGRSS Data Compromise

The vulnerability of the RSS/Atom/Pie LibGRSS library is related to errors in the TLS certificate validation process when loading streams. This occurs due to a standard behavior of the SoupSessionSync library. Exploiting this vulnerability could allow an attacker to compromise the integrity of da...

Xen Hypervisor Information Disclosure

The vulnerability of Xen hypervisors on ARM is related to the lack of cleaning of loading modules. Exploiting this vulnerability can allow an attacker to gain access to confidential data...

yara:pe_fuzzer: Heap-buffer-overflow in pe_get_section_full_name

Project: https://github.com/VirusTotal/yara.git Detailed Report: https://oss-fuzz.com/testcase?key=4884983219617792 Project: yara Fuzzing Engine: libFuzzer Fuzz Target: pefuzzer Job Type: libfuzzerasanyara Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6110000012bd...

WooCommerce Stock Manager CSRF

The vulnerability in the implementation of the /woocommerce-stock-manager/trunk/admin/views/import-export.php function, which handles plugin imports/exports for the WooCommerce Stock Manager content management system for WordPress, relates to unlimited loading of dangerous files. Exploiting this...

parlai code issue vulnerability

parlai is used to train and evaluate AI models on a variety of publicly available conversational datasets. parlai suffers from a code issue vulnerability that stems from an insecure loading package that is vulnerable to YAML deserialization attacks in the affected version. An attacker could explo...

gdk-pixbuf:stream_fuzzer: Heap-buffer-overflow in gdk_pixbuf__ico_image_load_increment

Project: https://gitlab.gnome.org/GNOME/gdk-pixbuf.git Detailed Report: https://oss-fuzz.com/testcase?key=5997924824252416 Project: gdk-pixbuf Fuzzing Engine: libFuzzer Fuzz Target: streamfuzzer Job Type: libfuzzerasangdk-pixbuf Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

Deserialization of untrusted data

parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by unsafe loading which leads to Arbitary code execution. This security bug is patched by avoiding...

CVE-2021-39207

parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by unsafe loading which leads to Arbitary code execution. This security bug is patched by avoiding...

gdk-pixbuf:animation_fuzzer: Heap-buffer-overflow in OneLine8

Project: https://gitlab.gnome.org/GNOME/gdk-pixbuf.git Detailed Report: https://oss-fuzz.com/testcase?key=4986768718954496 Project: gdk-pixbuf Fuzzing Engine: afl Fuzz Target: animationfuzzer Job Type: aflasangdk-pixbuf Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

CVE-2021-38338

The Border Loading Bar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the f and t parameter found in the /titan-framework/iframe-googlefont-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1...

CVE-2021-38338

The Border Loading Bar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the f and t parameter found in the /titan-framework/iframe-googlefont-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1...

Cross site scripting

The Border Loading Bar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the f and t parameter found in the /titan-framework/iframe-googlefont-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1...

CVE-2021-38338

The CVE-2021-38338 entry describes a Reflected Cross-Site Scripting vulnerability in the WordPress plugin Border Loading Bar (versions up to 1.0.1). The flaw is in the file ~/titan-framework/iframe-googlefont-preview.php, where the f and t parameters are used insecurely, allowing an attacker to i...