CVE-2021-42196

An issue was discovered in swftools through 20201222. A NULL pointer dereference exists in the function traitsparse located in abc.c. It allows an attacker to cause Denial of Service...

PT-2022-13915

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 4.4.2 FFmpeg versions prior to 5.0.1 Description An integer overflow issue was discovered in the g729 parse function located in libavcodec/g729 parser.c when handling a specially crafted file. This issue can be trigger...

Prototype Pollution

simple-plist is vulnerable to prototype pollution. The vulnerability exists because the validations are not handled properly which allows an attacker to inject properties into existing construct prototypes and modify attributes via .parse function...

GHSA-GFF7-G5R8-MG8M Prototype Pollution in simple-plist

simple-plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse...

Cross-site Scripting (XSS)

ajaxnetprofessional is vulnerable to cross-site scripting attacks. The vulnerability exists due to lack of input validation in parse function of AjaxPro/core.js in when parsing json input which allows a malicious attacker to inject and execute arbitrary javascript...

CVE-2021-22960

The parse function in llhttp 2.1.4 and 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling HRS under certain conditions...

CVE-2021-22960

The parse function in llhttp 2.1.4 and 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling HRS under certain conditions...

CVE-2021-22960

The parse function in llhttp 2.1.4 and 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling HRS under certain conditions...

Design/Logic Flaw

The parse function in llhttp 2.1.4 and 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling HRS under certain conditions...

CVE-2021-22960

The parse function in llhttp 2.1.4 and 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling HRS under certain conditions...

CVE-2021-22960

The parse function in llhttp 2.1.4 and 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling HRS under certain conditions...

CVE-2021-22960

The parse function in llhttp 2.1.4 and 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling HRS under certain conditions...

CVE-2021-22960

The parse function in llhttp 2.1.4 and 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling HRS under certain conditions...

CVE-2021-22960: Inconsistent Interpretation of HTTP Requests

The parse function in llhttp 2.1.4 and 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling HRS under certain conditions...

PT-2021-4366

Name of the Vulnerable Software and Affected Versions llhttp versions prior to 2.1.4 llhttp versions prior to 6.0.6 Description The issue is related to the parse function in llhttp, which ignores chunk extensions when parsing the body of chunked requests. This can lead to HTTP Request Smuggling H...

PT-2021-7944

Name of the Vulnerable Software and Affected Versions golang.org/x/text versions prior to 0.3.7 Description The issue is related to a denial-of-service attack that can occur due to an out-of-bounds read during BCP 47 language tag parsing. This happens because of mishandled index calculation. If...

Swftools code-related vulnerabilities

SWFTools is a suite of open source software tools for creating and manipulating SWF files. a null pointer dereference vulnerability exists in the codeparse function in SWFTools code.c. An attacker could exploit this vulnerability to cause a denial of service...

GHSA-G452-6RFC-VRVX Prototype Pollution in open-graph

This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a proto or constructor payload...

knot-dns:fuzz_zscanner: Stack-buffer-overflow in parse

Project: https://gitlab.labs.nic.cz/knot/knot-dns Detailed Report: https://oss-fuzz.com/testcase?key=5926354183913472 Project: knot-dns Fuzzing Engine: libFuzzer Fuzz Target: fuzzzscanner Job Type: libfuzzerasanknot-dns Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 2 Crash Address:...

CVE-2021-23419: Improperly Controlled Modification of Object Prototype Attributes

This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a proto or constructor payload...