Improper neutralization of data URIs may allow XSS in rails-html-sanitizer

Summary rails-html-sanitizer = 1.0.3, = 2.1.0. Mitigation Upgrade to rails-html-sanitizer = 1.4.4. Severity The maintainers have evaluated this as Medium Severity 6.1. References - CWE - CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' 4.9 - SVG MIME Type...

Improper neutralization of data URIs may allow XSS in Loofah

Summary Loofah = 2.1.0, = 2.19.1. Severity The Loofah maintainers have evaluated this as Medium Severity 6.1. References - CWE - CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' 4.9 - SVG MIME Type image/svg+xml is misleading to developers · Issue 266 ·...

GHSA-228G-948R-83GX Improper neutralization of data URIs may allow XSS in Loofah

Summary Loofah = 2.1.0, = 2.19.1. Severity The Loofah maintainers have evaluated this as Medium Severity 6.1. References - CWE - CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' 4.9 - SVG MIME Type image/svg+xml is misleading to developers · Issue 266 ·...

libredwg:llvmfuzz: Heap-buffer-overflow in dwg_decode_INSERT_private

Project: https://github.com/LibreDWG/libredwg.git Detailed Report: https://oss-fuzz.com/testcase?key=5136055417831424 Project: libredwg Fuzzing Engine: libFuzzer Fuzz Target: llvmfuzz Job Type: libfuzzerasanlibredwg Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

loki:fuzz_parse_expr: Crash in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5584593271259136 Project: loki Fuzzing Engine: libFuzzer Fuzz Target: fuzzparseexpr Job Type: libfuzzerasanloki Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7fed0f688cf8 Crash State: pthreadcreate cgotrypthreadcreate pthreadcreate...

USN-5686-1: Git vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Description Cory Snider discovered that Git incorrectly handled certain symbolic links. An attacker could possibly use this issue to cause an unexpected behaviour. CVE-2022-39253 Kevin Backhouse discovered that Git...

USN-5675-1: Heimdal vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description Isaac Boukris and Andrew Bartlett discovered that Heimdal’s KDC was not properly performing checksum algorithm verifications in the S4U2Self extension module. An attacker could...

cups:FuzzIPP: Use-of-uninitialized-value in compare_sp_items

Project: https://github.com/OpenPrinting/cups.git Detailed Report: https://oss-fuzz.com/testcase?key=5963877118771200 Project: cups Fuzzing Engine: libFuzzer Fuzz Target: FuzzIPP Job Type: libfuzzermsancups Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

libraw:libraw_raf_fuzzer: Use-of-uninitialized-value in LibRaw::getwords

Project: https://github.com/libraw/libraw.git Detailed Report: https://oss-fuzz.com/testcase?key=5095984101457920 Project: libraw Fuzzing Engine: libFuzzer Fuzz Target: librawraffuzzer Job Type: libfuzzermsanlibraw Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

hunspell:affdicfuzzer: Heap-buffer-overflow in AffixMgr::cpdpat_check

Project: https://github.com/hunspell/hunspell.git Detailed Report: https://oss-fuzz.com/testcase?key=6319707827601408 Project: hunspell Fuzzing Engine: libFuzzer Fuzz Target: affdicfuzzer Job Type: libfuzzerasani386hunspell Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

imagemagick:encoder_bmp3_fuzzer: Use-of-uninitialized-value in cmsMLUgetASCII

Detailed Report: https://oss-fuzz.com/testcase?key=6303687767359488 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderbmp3fuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: cmsMLUgetASCII...

libraw:libraw_nef_fuzzer: Use-of-uninitialized-value in LibRaw::canon_600_auto_wb

Project: https://github.com/libraw/libraw.git Detailed Report: https://oss-fuzz.com/testcase?key=5289315678945280 Project: libraw Fuzzing Engine: libFuzzer Fuzz Target: librawneffuzzer Job Type: libfuzzermsanlibraw Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

CVE-2022-4192

Use after free in Live Caption in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via UI interaction. Chromium security severity: Medium...

CVE-2022-4189

Insufficient policy enforcement in DevTools in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2022-4184

Insufficient policy enforcement in Autofill in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass autofill restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2022-4182

Inappropriate implementation in Fenced Frames in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass fenced frame restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2022-4183

Insufficient policy enforcement in Popup Blocker in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Medium...

DEBIAN-CVE-2022-4183

Insufficient policy enforcement in Popup Blocker in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2022-4191

Use after free in Sign-In in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via profile destruction. Chromium security severity: Medium...

UBUNTU-CVE-2022-4187

Insufficient policy enforcement in DevTools in Google Chrome on Windows prior to 108.0.5359.71 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. Chromium security severity: Medium...