nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode

A flaw was found in ssri package. A malicious string provided by an attacker may lead to Regular Expression Denial of Service ReDoS. This issue only affects consumers using the strict option. The highest threat from this vulnerability is to availability...

SUSE SLED15 / SLES15 Security Update : transfig (SUSE-SU-2021:2454-1)

The remote SUSE Linux SLED15 / SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2454-1 advisory. Update to version 3.2.8, including fixes for - CVE-2021-3561: overflow in fig2dev/read.c in function readcolordef bsc1186329. -...

OpenSSL DoS Vulnerability (20180327) - Linux

OpenSSL is prone to a denial of service DoS vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; yo...

Denial Of Service (DoS)

openexr is vulnerable to denial of service. An attacker is able to cause a denial of service condition in the application via a malicious input file that would result in a undefined bitwise right shift...

Denial Of Service

radare2 is vulnerable to denial of service. The vulnerability exists due to a segmentation fault in parsetypedef in typedwarf.c via a malformed DWATname in the .debuginfo section which allows an attacker to crash the application via malicious input...

Cross-site Scripting (XSS)

Overview anchorme is an A library to convert URLs to a clickable HTML anchor elements Affected versions of this package are vulnerable to Cross-site Scripting XSS via the main functionality. It accepts input that can result in the output an anchor a tag containing undesirable Javascript code that...

MGASA-2021-0238 Updated cgal packages fix security vulnerabilities

Updated cgal packages fix security vulnerabilities: An oob read vulnerability exists in Nef2/PMioparser.h PMioparser::readvertex Faceof OOB read. An attacker can provide malicious input to trigger this vulnerability CVE-2020-28601. An oob read vulnerability exists in NefS2/SNCioparser.h...

MGASA-2021-0239 Updated cgal packages fix security vulnerabilities

Updated cgal packages fix security vulnerabilities: An oob read vulnerability exists in Nef2/PMioparser.h PMioparser::readvertex Faceof OOB read. An attacker can provide malicious input to trigger this vulnerability CVE-2020-28601. An oob read vulnerability exists in NefS2/SNCioparser.h...

fig2dev buffer overflow vulnerability (CNVD-2021-86900)

Xfig fig2dev is a tool for printing and exporting .fig format files. A buffer overflow vulnerability exists in Fig2dev version 3.2.8a, which stems from a flawed boundary check in the program's read objects function, and can be exploited by an attacker to provide crafted, malicious input that can...

CVE-2021-3561

An Out of Bounds flaw was found fig2dev version 3.2.8a. A flawed bounds check in readobjects could allow an attacker to provide a crafted malicious input causing the application to either crash or in some cases cause memory corruption. The highest threat from this vulnerability is to integrity as...

CVE-2021-3561

An Out of Bounds flaw was found fig2dev version 3.2.8a. A flawed bounds check in readobjects could allow an attacker to provide a crafted malicious input causing the application to either crash or in some cases cause memory corruption. The highest threat from this vulnerability is to integrity as...

Path Traversal

rollup-plugin-serve is vulnerable to path traversal. The readFile operation does not escape the urlPath, allowing an attacker to input malicious characters to access files and directories that are outside the destination folder...

Prototype Pollution

101 is vulnerable to prototype pollution. An attacker is able to send a malicious input as it does not validate the values passed into the key argument, leading to denial of service and remote code execution...

Denial Of Service (DoS)

tensorflow is vulnerable to denial of service. An attacker is able to send a malicious input to cause a memory overflow in ParseAttrValue from nested tensors...

Denial Of Service (DoS)

tensorflow is vulnerable to denial of service. An attacker is able to send a malicious input to cause null pointer dereference in TrySimplify, crashing the application...

Denial Of Service (DoS)

tensorflow is vulnerable to denial of service. An attacker is able to send a malicious input to cause out of bounds read in tf.rawops.MaxPoolGradWithArgmax, leading to an application crash...

Arbitrary Code Injection

Overview In xmlhttprequest-ssl before 1.6.2 when requests are sent synchronously async=False on xhr.open, malicious user input flowing into xhr.send could result in arbitrary code being injected and run. Recommendation Upgrade to version 1.6.2 or later References CVE GitHub Advisory...

Denial Of Service (DoS)

django-filters is vulnerable to denial of service. An attacker is able to cause an application crash by submitting malicious input using exponential format with large exponents...

Django 安全漏洞

Django is the Django Foundation's set of open source Web application framework based on the Python language . The framework includes an object-oriented mapper, view system, template system, and more. A security vulnerability exists in Django-filter versions prior to 2.4.0, which stems from being...

DEBIAN-CVE-2021-29482

xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size o...