26 matches found
LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration
Summary LiquidJS’s ownPropertyOnly option is intended to prevent templates from reading inherited or prototype properties from scope data. With ownPropertyOnly: true, direct access such as: liquid a0 correctly blocks an inherited array index. However, the same inherited value is still disclosed...
CVE-2026-106120
The LiquidJS template engine (prior to version 10.27.2 ) contains a vulnerability where the ownPropertyOnly setting can be bypassed. Specific operations—including negative indexing, .first, .last, join, reverse, slice, compact, and for-loop iterations—can read prototype-provided elements outside ...
CVE-2026-106120 LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, enabling ownPropertyOnly does not consistently restrict inherited array indices because negative indexing, .first, .last, the first filter, the last filter, join, reverse, slice, compact, and...
CVE-2026-106120: Exposure of Sensitive Information to an Unauthorized Actor
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, enabling ownPropertyOnly does not consistently restrict inherited array indices because negative indexing, .first, .last, the first filter, the last filter, join, reverse, slice, compact, and...
Google Go 安全漏洞
Google Go is a static, strongly typed, compiled, concurrent programming language with garbage collection features from the American company Google. There is a security vulnerability in Google Go, which stems from the failure to correctly validate offsets when processing JSON inputs with formattin...
SUSE CVE-2023-54186
In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: fix pinassignmentshow This patch fixes negative indexing of buf array in pinassignmentshow when getcurrentpinassignments returns 0 i.e. no compatible pin assignments are found. BUG: KASAN:...
EUVD-2023-60455
In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: fix pinassignmentshow This patch fixes negative indexing of buf array in pinassignmentshow when getcurrentpinassignments returns 0 i.e. no compatible pin assignments are found. BUG: KASAN:...
CVE-2023-54186
In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: fix pinassignmentshow This patch fixes negative indexing of buf array in pinassignmentshow when getcurrentpinassignments returns 0 i.e. no compatible pin assignments are found. BUG: KASAN:...
CVE-2023-54186
In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: fix pinassignmentshow This patch fixes negative indexing of buf array in pinassignmentshow when getcurrentpinassignments returns 0 i.e. no compatible pin assignments are found. BUG: KASAN:...
UBUNTU-CVE-2023-54186
In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: fix pinassignmentshow This patch fixes negative indexing of buf array in pinassignmentshow when getcurrentpinassignments returns 0 i.e. no compatible pin assignments are found. BUG: KASAN:...
CVE-2023-54186
CVE-2023-54186 is a Linux kernel vulnerability affecting the USB Type-C altmodes/displayport code. The issue arises from a patch that fixes the negative indexing of the buf array in pin_assignment_show when get_current_pin_assignments returns 0 (no compatible pin assignments). The bug led to a KA...
CVE-2023-54186 usb: typec: altmodes/displayport: fix pin_assignment_show
In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: fix pinassignmentshow This patch fixes negative indexing of buf array in pinassignmentshow when getcurrentpinassignments returns 0 i.e. no compatible pin assignments are found. BUG: KASAN:...
EUVD-2024-41758
Malicious code in bioql PyPI...
EUVD-2022-0291
Malicious code in bioql PyPI...
CLSA-2025-1758193800 php: Fix of CVE-2020-7067
CVE-2020-7067: fix negative indexing in phpurldecode function...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the ALSA hda/via component potentially accessing negatively indexed arrays in the addsecretdacpath function...
CVE-2022-21728
Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for ReverseSequence does not fully validate the value of batchdim and can result in a heap OOB read. There is a check to make sure the value of batchdim does not go over the rank of the input, but there...
CVE-2024-45573
Memory corruption may occour while generating test pattern due to negative indexing of display ID...
