2517 matches found
CVE-2020-7791
CVE-2020-7791 affects the i18n package before 2.1.15. Root cause: insufficient handling of erroneous language tags in src/i18n/Concrete/TextLocalizer.cs and src/i18n/LocalizedApplication.cs. Impact: Denial of service ( DoS ), including a null pointer dereference per Veracode reference, with condi...
CVE-2020-7793
The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service ReDoS in multiple regexes see linked commit for more info...
PT-2020-17272 · Alt +3 · Alt Linux +2
Name of the Vulnerable Software and Affected Versions: ALT Linux affected versions not specified Description: The issue concerns a package vulnerability in ALT Linux. No specific details about the vulnerability, affected devices, or real-world incidents are provided. Recommendations: At the momen...
Input validation
This affects all versions of package react-adal. It is possible for a specially crafted JWT token and request URL can cause the nonce, session and refresh values to be incorrectly validated, causing the application to treat an attacker-generated JWT token as authentic. The logical defect is cause...
Code injection
Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF. An attacker can perform a large range of requests to ARIN reserved IP ranges, resulting in an indeterminable number of critical attack vectors, allowing remote...
Design/Logic Flaw
This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program...
CVE-2020-7772
This affects the package doc-path before 2.1.2...
Design/Logic Flaw
This affects the package doc-path before 2.1.2...
MGASA-2020-0420 Updated arpwatch package fixes a security vulnerability
A buffer overflow from long hostnames. rhbz1563939...
CVE-2020-7769
This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails...
Oracle Linux 8 : targetcli (ELSA-2020-4697)
The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-4697 advisory. 2.1.53-1 - Update to new upstream version 2.1.52-1 - Update to new upstream version Tenable has extracted the preceding description block directly from the Orac...
Design/Logic Flaw
All versions of package express-validators are vulnerable to Regular Expression Denial of Service ReDoS when validating specifically-crafted invalid urls...
Design/Logic Flaw
This affects the package phantom-html-to-pdf before 0.6.1...
CVE-2020-7761
This affects the package @absolunet/kafe before 3.2.10. It allows cause a denial of service when validating crafted invalid emails...
Denial of service
This affects the package @absolunet/kafe before 3.2.10. It allows cause a denial of service when validating crafted invalid emails...
Code injection
This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS...
CVE-2020-7742 Prototype Pollution
This affects the package simpl-schema before 1.10.2...
CVE-2020-7741 Cross-site Scripting (XSS)
This affects the package hellojs before 1.18.6. The code get the param oauthredirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauthredirect, such as javascript:alert1...
