CVE-2022-21222

The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service ReDoS due to the usage of insecure regular expression in the reattr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function...

CVE-2022-21169 Prototype Pollution

The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization...

Mageia: Security Advisory (MGASA-2022-0346)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for zlib (EulerOS-SA-2022-2371)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2022:3334-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Arbitrary Code Execution

d8spython is vulnerable to arbitrary code execution. The vulnerability exists because the democritus-strings package of a specific version of d8spython acts as a potential code execution backdoor which allows an attacker to inject and execute malicious codes in to the system...

d8s-dates (0.1.0) potentially affected by unknown CVE via democritus-timezones (2021.1.201)

democritus-timezones PYPI version 2021.1.201 is affected by a known vulnerability. The following packages have a transitive dependency on democritus-timezones and may be impacted: - d8s-dates 0.1.0 Source cves: unknown CVE Source advisory: SNYK:PYTHON-DEMOCRITUSTIMEZONES-8400832...

PT-2022-37370 · Pypi · Democritus-Hypothesis +1

Name of the Vulnerable Software and Affected Versions: d8s-ip-addresses version 0.1.0 Description: The d8s-ip-addresses package for python, distributed on PyPI, contains a potential code-execution backdoor. This backdoor is inserted by a third party through the democritus-hypothesis package...

CVE-2022-2816 affecting package vim 9.0.0181-1

CVE-2022-2816 affecting package vim 9.0.0181-1. An upgraded version of the package is available that resolves this issue...

CVE-2022-32189 affecting package golang for versions less than 1.18.5-1

CVE-2022-32189 affecting package golang for versions less than 1.18.5-1. An upgraded version of the package is available that resolves this issue...

CVE-2015-20107 affecting package python3 for versions less than 3.9.13-5

CVE-2015-20107 affecting package python3 for versions less than 3.9.13-5. A patched version of the package is available...

CVE-2021-42523 affecting package colord for versions less than 1.4.4-9

CVE-2021-42523 affecting package colord for versions less than 1.4.4-9. A patched version of the package is available...

CVE-2022-2309 affecting package python-lxml for versions less than 4.9.1-1

CVE-2022-2309 affecting package python-lxml for versions less than 4.9.1-1. An upgraded version of the package is available that resolves this issue...

Design/Logic Flaw

This affects the package com.diffplug.gradle:goomph before 3.37.2. It allows a malicious zip file to potentially break out of the expected destination directory, writing contents into arbitrary locations on the file system. Overwriting certain files/directories could allow an attacker to achieve...

CVE-2022-2509 affecting package gnutls for versions less than 3.7.7-1

CVE-2022-2509 affecting package gnutls for versions less than 3.7.7-1. An upgraded version of the package is available that resolves this issue...

CVE-2022-30698 affecting package unbound for versions less than 1.16.2-1

CVE-2022-30698 affecting package unbound for versions less than 1.16.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2022-25857

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service DoS due missing to nested depth limitation for collections...

CVE-2022-25857

CVE-2022-25857 affects the Java YAML parser SnakeYAML (org.yaml:snakeyaml) up to and including 1.31. The root cause is a missing nested depth limit for collections, leading to Denial of Service (DoS) under crafted input. Several connected advisories confirm DoS impact and reference historical fix...

CVE-2022-25644

All versions of package @pendo324/get-process-by-name are vulnerable to Arbitrary Code Execution due to improper sanitization of getProcessByName function...

CVE-2022-25644

CVE-2022-25644 affects the npm package @pendo324/get-process-by-name, with all versions vulnerable to Arbitrary Code Execution due to improper sanitization of the getProcessByName function. The root cause is mishandling of input that allows code injection, enabling remote attackers to execute arb...