CVE-2016-1000235

Vulnerability context (CVE-2016-1000235 / FuelUX) A cross-site scripting flaw affects the FuelUX library’s Pillbox feature. By supplying a script as the value for a new pillbox, an attacker can achieve arbitrary script execution. Affected versions are stated as vulnerable; no exact version range ...

CVE-2016-1000238

The CVE-2016-1000238 entry is linked to node-krb5 SPOOFING via unvalidated KDC. Affected: node-krb5 (Node.js module). Issue: KDC is not validated before authentication, allowing a network-attacker with time and access to spoof the KDC and impersonate a valid user without credentials. Impact: pote...

CVE-2014-8881

Summary: The connected advisories indicate a Regular Expression Denial of Service (ReDoS) affecting all versions of the Python package bleach during its sanitize function. The issue is not tied to a specific version release in the provided documents; the advisories state all versions are vulnerab...

CVE-2013-3364

CVE-2013-3364 aligns with a GitHub advisory and OSV entry describing unauthenticated remote command injection in the ep_imageconvert plugin for Etherpad Lite. The vulnerability affects ep_imageconvert

CVE-2016-1000223

The CVE entry CVE-2016-1000223 has no public details in the Initial document. Connected documents reveal a vulnerability in the jws package (GitHub advisory GHSA-GJCW-V447-2W7Q / OSV entry) where users can select the JWT verification algorithm, allowing a malicious actor to modify a JWT while sti...

CVE-2016-1000224

The connected advisories describe a vulnerability in ezseed-transmission: affected versions download/run a script over HTTP, enabling a privileged-network attacker to perform a Man‑in‑the‑Middle attack and replace the script with malicious code, compromising the system running ezseed-transmission...

CVE-2015-7982

Vulnerability details found: The gm library (Node.js wrapper) versions prior to 1.21.1 are affected by a command-injection flaw. The issue occurs when user input is passed to gm.compare() without proper sanitization before invoking the GraphicsMagick binary. Remediation: update to version 1.21.1 ...

CVE-2016-1000241

The CVE entry (CVE-2016-1000241) is linked to a known XSS vulnerability in pivottable. Affected software: pivottable (JavaScript library). Issue: a new rendering mechanism for JSON elements introduces cross-site scripting, enabling injection through JSON-rendered content. References from connecte...

CVE-2017-16034

The CVE-2017-16034 entry maps to a real vulnerability in the Node.js pidusage package: affected versions pass unsanitized input to child_process.exec(), allowing arbitrary code execution in the ps method. The PoC is viable on Darwin, SunOS, FreeBSD, and AIX; Windows and Linux are not affected. Re...

CVE-2014-8882

The connected advisories identify a Regular Expression Denial of Service in the validator library’s isURL method affecting versions prior to 3.22.1; remediation is to update to 3.22.1 or later (GHSA-f5w6-r7rg-mcgq, OSV GHSA, and NODEJS advisory 42 reference validator.js). No exploitation details ...

CVE-2016-1000234

The CVE-2016-1000234 entry maps to a Cross-Site Scripting issue in the jqTree component. Connected advisories (GHSA-GJHX-GXWX-JX9J and OSV) describe that affected versions of jqtree are vulnerable to XSS via the drag-and-drop operation when modifying tree data, allowing script content within a no...

CVE-2016-1000240

The connected advisories identify a Cross-Site Scripting (XSS) vulnerability in the c3 JavaScript charting library. Affected versions are vulnerable to XSS due to improper sanitization of HTML in rendered tooltips. The issue is documented in GHSA-GVG7-PP82-CFF3 and mirrored in OSV and npm advisor...

CVE-2014-4179

The CVE-2014-4179 entry is linked to a denial-of-service issue in the yar library. Affected software: yar prior to 2.2.0. Root cause: invalid encrypted session cookie value causes the process to crash, leading to DoS. Impact: service disruption; no exploitation details provided in the documents. ...

CVE-2016-1000231

The CVE placeholder CVE-2016-1000231 is linked to a real issue in the emoji rendering library emojione. Affected versions are vulnerable to cross-site scripting (XSS) when user input is fed into functions such as toShort(), shortnameToImage(), unicodeToImage(), and toImage(). The root cause is im...

CVE-2013-7035

Technical details for CVE-2013-7035 are not publicly available in the provided documents; the CVE entry appears reserved. Monitor for updates.

CVE-2021-27366

Technical details for CVE-2021-27366 are not publicly available in the provided documents. Monitor for updates.

CVE-2014-3143

CVE-2014-3143 is not just a placeholder; connected documents describe multiple curl/libcurl vulnerabilities. The issues involve memory safety in path handling and hostname parsing: (1) sanitize_cookie_path() may index memory with -1 when a path is a single double-quote, destroying heap memory; (2...

CVE-2017-1307

Technical details for CVE-2017-1307 are not publicly available in the provided documents. Monitor for updates as new information may be published later.

CVE-2021-11192

Technical details for CVE-2021-11192 are not publicly available in the provided documents. Monitor for updates.

CVE-2021-11191

Technical details for CVE-2021-11191 are not publicly available in the provided documents. Monitor for updates; no affected products, exploit info, or remediation details are stated in the supplied material.