Prototype Pollution in ionicabizau/obj-unflatten

Description obj-unflatten convert flatten objects in nested ones. This package is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: javascript // poc.js const unflatten = require'obj-unflatten' console.log'Before: ' + .polluted unflatten'proto.polluted':...

PT-2020-22514

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-double-free crash. Technical details include the crash type and state, with function names such as mrb default allocf, mrb...

PT-2020-22510

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A crash occurred due to an unknown read issue, as reported by OSS-Fuzz. The crash state involves str decref, obj free, and mrb gc destroy functions. No...

PT-2020-13660

Name of the Vulnerable Software and Affected Versions rust-vmm vm-memory versions 0.1.0 through 0.1.1 and 0.2.x before 0.2.1 Description The issue allows attackers to cause a denial of service, specifically a loss of IP networking, due to improper memory access by the read obj and write obj...

PT-2019-7428

Name of the Vulnerable Software and Affected Versions content-grabber plugin version 1.0 Description The issue concerns a cross-site scripting XSS problem. It is exploited via the obj field name or obj field id variables. Recommendations For content-grabber plugin version 1.0, consider disabling...

PT-2019-2257

Name of the Vulnerable Software and Affected Versions NuGet Package Manager affected versions not specified Description The issue is related to insufficient access control in the NuGet package management system. It allows an authenticated attacker to modify the contents of the intermediate build...

PT-2019-9851

Name of the Vulnerable Software and Affected Versions Systrome ISG-600C version 1.1-R2.1 TRUNK-20180914.bin Systrome ISG-600H version 1.1-R2.1 TRUNK-20180914.bin Systrome ISG-800W version 1.1-R2.1 TRUNK-20180914.bin Description The issue is related to a lack of CSRF token validation, which allows...

Blog2Social <= 5.0.0 - PHP Obj Injection

The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin was affected by a PHP Obj Injection security vulnerability...

Double free

dwgdecodeeed in decode.c in GNU LibreDWG before 0.6 leads to a double free in dwgfreeeed in free.c because it does not properly manage the obj-eed value after a free occurs...

CVE-2018-14524

dwgdecodeeed in decode.c in GNU LibreDWG before 0.6 leads to a double free in dwgfreeeed in free.c because it does not properly manage the obj-eed value after a free occurs...

PT-2018-12540

Name of the Vulnerable Software and Affected Versions GNU LibreDWG version 0.5.1048 Description The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and SEGV, via a crafted dwg file. This is due to a problem in the dwg obj block control get block...

CVE-2018-13622

The mintToken function of a smart contract implementation for ObjectToken OBJ, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...

CVE-2018-13222: Integer Overflow or Wraparound

The sell function of a smart contract implementation for ObjectToken OBJ, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

PT-2018-4689

Name of the Vulnerable Software and Affected Versions Android versions prior to 2018-04-05 security patch level Description A buffer overflow issue occurs when a negative value is passed as the argument max to the function qurt qdi state local new handle from obj. This happens due to the...

CVE-2018-1000042

Security Onion Solutions Squert version 1.3.0 through 1.6.7 contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in .inc/callback.php that can result in execution of OS Commands. This attack appear to be exploitable via Web reques...

CVE-2018-1000042: Improper Neutralization of Special Elements used in an OS Command

Security Onion Solutions Squert version 1.3.0 through 1.6.7 contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in .inc/callback.php that can result in execution of OS Commands. This attack appear to be exploitable via Web reques...

PT-2018-9229

Name of the Vulnerable Software and Affected Versions: Security Onion Solutions Squert versions 1.3.0 through 1.6.7 Description: The issue is related to an OS Command Injection vulnerability in the .inc/callback.php file. This can result in the execution of OS commands. The attack is exploitable...

PT-2018-17624

Name of the Vulnerable Software and Affected Versions Artifex MuPDF version 1.12.0 Description The issue allows remote attackers to cause a denial of service via a crafted PDF document. This is due to the pdf load obj stm function in pdf/pdf-xref.c referencing the object stream recursively, which...

PT-2017-14288

Name of the Vulnerable Software and Affected Versions Ox gem version 2.8.0 Description The Ox gem for Ruby crashes with a segmentation fault when a crafted input is supplied to the parse obj function. The vendor has stated that Ox should handle the error more gracefully but has not confirmed a...

PT-2017-3576

Name of the Vulnerable Software and Affected Versions: Android versions 7.0 through 8.1 Description: The issue is related to the handling of ps codec obj memory allocation failures in the Android media framework, specifically in the libhevc library. This could potentially allow a remote attacker ...