572 matches found
CVE-2024-25282
3DSecure 2.0 allows XSS in its 3DSMethod Authentication via a modified params parameter in a /rest/online request with a /redirect?action=challenge&txn= substring...
Mass-Assigner - Simple Tool Made To Probe For Mass Assignment Vulnerability Through JSON Field Modification In HTTP Requests
Mass Assigner is a powerful tool designed to identify and exploit mass assignment vulnerabilities in web applications. It achieves this by first retrieving data from a specified request, such as fetching user profile data. Then, it systematically attempts to apply each parameter extracted from th...
CVE-2024-45813
CVE-2024-45813 affects the find-my-way HTTP router. A bad regular expression is generated when two parameters exist within a single segment, notably with a trailing dash (e.g., ":/a-:b-"). This can lead to a Denial of Service in some cases. Affected versions require upgrade to find-my-way v8.2.2 ...
CVE-2024-45813 ReDoS vulnerability in multiparametric routes in find-my-way
find-my-way is a fast, open source HTTP router, internally using a Radix Tree aka compact Prefix Tree, supports route params, wildcards, and it's framework independent. A bad regular expression is generated any time one has two parameters within a single segment, when adding a - at the end, like...
PT-2024-20857
Name of the Vulnerable Software and Affected Versions 3DSecure 2.0 version 3DS Method Authentication Description The issue concerns a Cross-Site Scripting XSS vulnerability in the 3DSMethod Authentication of 3DSecure 2.0. This vulnerability can be exploited via a modified params parameter in a...
PT-2026-28656
Name of the Vulnerable Software and Affected Versions path-to-regexp versions prior to 0.1.13 Description A flawed regular expression is generated when three or more parameters are present within a single segment, separated by characters other than a period .. For example, /:a-:b-:c or...
PT-2024-31549
Name of the Vulnerable Software and Affected Versions path-to-regexp versions prior to 0.1.10 path-to-regexp versions prior to 8.0.0 Description The issue arises when path-to-regexp generates a regular expression that can cause poor performance, leading to a Denial of Service DoS. This occurs whe...
CVE-2024-43895
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2024-43895
...
CVE-2024-43895
CVE-2024-43895 relates to the Linux kernel DRM/AMD display path, specifically a NULL pointer dereference when recomputing DSC parameters if no stream is on the link during MST+DSC setup. This can trigger a kernel oops/crash as described in vendor advisories. Connected sources show the issue is ad...
AZL-48197 CVE-2024-43884 affecting package kernel for versions less than 6.6.51.1-5
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Add error handling to pairdevice hciconnparamsadd never checks for a NULL value and could lead to a NULL pointer dereference causing a crash. Fixed by adding error handling in the function...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a potential out-of-bounds access in the dml2calculaterqanddlgparams function due to the index of the...
streamlit-geospatial 安全漏洞
streamlit-geospatial is an Open Geospatial Solutions open source streamlit multi-page application for geospatial applications. A security vulnerability exists in streamlit-geospatial, which originates in pages/1? The visparams variable in Timelapse.py accepts user input that is then used in the...
CVE-2023-52291
The Apache StreamPark development and management environment is vulnerable to command injection in its "Project" module due to insufficient validation of Maven build arguments. Specifically, the "<" operator is not correctly processed, allowing an attacker to execute arbitrary commands (e.g., ...
Path Traversal
@jmondi/url-to-png is vulnerable to Path Traversal. The vulnerability is due to the lack of proper sanitization or validation of the ImageId input within extractqueryparams.ts, which allows an attacker to store an image in an arbitrary location that the server has permission to access...
Malicious code in ez-get-url-params (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-2353 Malicious code in ez-get-url-params (npm)
--- -= Per source details. Do not edit below this line.=-...
CVE-2021-47443 NFC: digital: fix possible memory leak in digital_tg_listen_mdaa()
In the Linux kernel, the following vulnerability has been resolved: NFC: digital: fix possible memory leak in digitaltglistenmdaa 'params' is allocated in digitaltglistenmdaa, but not free when digitalsendcmd failed, which will cause memory leak. Fix it by freeing 'params' if digitalsendcmd retur...
DEBIAN-CVE-2023-52866
In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: Fix user-memory-access bug in uclogicparamsugeev2initeventhooks When CONFIGHIDUCLOGIC=y and CONFIGKUNITALLTESTS=y, launch kernel and then the below user-memory-access bug occurs. In...