Path Traversal

rollup-plugin-serve is vulnerable to path traversal. The readFile operation does not escape the urlPath, allowing an attacker to input malicious characters to access files and directories that are outside the destination folder...

Prototype Pollution

101 is vulnerable to prototype pollution. An attacker is able to send a malicious input as it does not validate the values passed into the key argument, leading to denial of service and remote code execution...

Denial Of Service (DoS)

tensorflow is vulnerable to denial of service. An attacker is able to send a malicious input to cause a memory overflow in ParseAttrValue from nested tensors...

Denial Of Service (DoS)

tensorflow is vulnerable to denial of service. An attacker is able to send a malicious input to cause null pointer dereference in TrySimplify, crashing the application...

Denial Of Service (DoS)

tensorflow is vulnerable to denial of service. An attacker is able to send a malicious input to cause out of bounds read in tf.rawops.MaxPoolGradWithArgmax, leading to an application crash...

Arbitrary Code Injection

Overview In xmlhttprequest-ssl before 1.6.2 when requests are sent synchronously async=False on xhr.open, malicious user input flowing into xhr.send could result in arbitrary code being injected and run. Recommendation Upgrade to version 1.6.2 or later References CVE GitHub Advisory...

Denial Of Service (DoS)

django-filters is vulnerable to denial of service. An attacker is able to cause an application crash by submitting malicious input using exponential format with large exponents...

Django 安全漏洞

Django is the Django Foundation's set of open source Web application framework based on the Python language . The framework includes an object-oriented mapper, view system, template system, and more. A security vulnerability exists in Django-filter versions prior to 2.4.0, which stems from being...

CVE-2021-29482

xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size o...

DEBIAN-CVE-2021-29482

xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size o...

UBUNTU-CVE-2021-29482

xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size o...

xz 安全漏洞

xz is a software application. It is used to support reading and writing xz compressed streams. A security vulnerability exists in versions prior to xz v0.5.8, which stems from the readUvarint function used to read the xz container format may not terminate the loop to provide malicious input...

py vulnerable to Regular Expression Denial of Service

A denial of service via regular expression in the py.path.svnwc component of py aka python-py through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality...

Directory Traversal

commons-io is vulnerable to Directory Traversal. Invoking the method FileNameUtils.normalize with a malicious input string would potentially allow access to files within the parent directory...

PT-2021-14769 · Accusoft · Accusoft Imagegear

Name of the Vulnerable Software and Affected Versions: Accusoft ImageGear version 19.8 Description: An out-of-bounds write issue exists in the JPG format SOF marker processing. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger th...

Regular Expression Denial Of Service (ReDoS)

html-parse-stringify2 is vulnerable to regular expression denial of service. An attacker is able to crash the application by submitting a malicious tag via the parse function...

XStream 代码问题漏洞

XStream is a simple Java-based library , Java objects serialized to xml and vice versa i.e. : Java objects and xml documents can easily be converted to each other . A code execution vulnerability exists in XStream, which can be exploited by an attacker to manipulate the processed input stream and...

Sindre Sorhus is-svg 安全漏洞

Sindre Sorhus is-svg is Sindre Sorhus an open source application. Provides a string or buffer to check whether the SVG function . A security vulnerability exists in is-svg package 2.1.0 through 4.2.1, which can be exploited by an attacker to supply a malicious string, causing is-svg to be unable ...

JFrog < 6.1 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 6.1. It is, therefore, affected by multiple vulnerabilities: - A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which...

Denial Of Service (DoS)

libconvert-asn1-perl is vulnerable to denial of service. A remote attacker is able to cause an infinite loop processing via a malicious input which leads to an application crash...