91 matches found
ruby: Cookie prefix spoofing in CGI::Cookie.parse
A flaw was found in Ruby. RubyGems cgi gem could allow a remote attacker to conduct spoofing attacks caused by the mishandling of security prefixes in cookie names in the CGI::Cookie.parse function. By sending a specially-crafted request, an attacker could perform cookie prefix spoofing attacks...
Vulnerabilities of functions mbedtls_ecp_check_pub_priv, mbedtls_pk_parse_key, mbedtls_pk_parse_keyfile, mbedtls_ecp_mul, and mbedtls_ecp_mul_restartable in TLS and SSL protocol implementations. These vulnerabilities allow attackers to access confidential data.
The vulnerabilities of functions mbedtlsecpcheckpubpriv, mbedtlspkparsekey, mbedtlspkparsekeyfile, mbedtlsecpmul, and mbedtlsecpmulrestartable in TLS and SSL protocols involve information disclosure due to inconsistencies. Exploiting these vulnerabilities allows a remote attacker to gain access t...
Simple-Plist 安全漏洞
Simple-Plist is a simple API for interacting with binary and plain text Plist data from Joe Wollard, a personal developer in the US. A security vulnerability exists in wollardj Simple-Plist v1.3.0, which stems from a prototype contamination vulnerability in .parse...
Authorization Bypass
url-parse is vulnerable to authorization bypass. The use of User-Controlled Key allows an attacker to transform original invalid URL into a valid one with url.pathname as host...
GHSA-4CPG-3VGW-4877 Prototype pollution in Plist before 3.0.5 can cause denial of service
Prototype pollution vulnerability via .parse in Plist allows attackers to cause a Denial of Service DoS and may lead to remote code execution...
NPM url-parse 安全漏洞
Url-Parse is a small Url parser that works seamlessly across Node.js and browser environments. A security vulnerability exists in NPM url-parse that stems from bypassing authorization via a user-controlled key in NPM url-parse before 1.5.6...
0x-relayer-cat (>=0.0.3 <=0.0.10), @0x-klaytn/asset-swapper (>=4.2.1 <=4.2.2) +724 more potentially affected by CVE-2020-8124 via url-parse (>=0.1.5 <=1.4.4)
url-parse NPM version =0.1.5, =0.0.3, =4.2.1, =2.1.0-beta.4, =5.0.0-beta, =0.1.0-beta.2, =0.0.1, =0.1.1, =0.0.1, =0.1.0, =0.0.0-4, =0.0.1, =1.2.5, =1.5.0, =0.1.0, =0.1.7 and more Source cves: CVE-2020-8124 Source advisory: OSV:GHSA-46C4-8WRP-J99V...
DEBIAN-CVE-2021-41817
Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS regular expression Denial of Service via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1...
nodejs-ini: Prototype pollution via malicious INI file
A flaw was found in nodejs-ini. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context...
Regular Expression Denial of Service (ReDoS)
Overview date is a subclass of Object includes Comparable module for handling dates. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS. Date’s parsing methods including Date.parse are using regular expressions internally, some of which are vulnerable...
960.css (=1.0.0), @4site/engrid-styles (>=0.2.19 <=0.2.24) +124 more potentially affected by CVE-2021-23343 via path-parse (>=1.0.5 <=1.0.6)
path-parse NPM version =1.0.5, =0.2.19, =0.1.1, =7.0.0, =0.2.0, =0.17.0, =0.17.0, =0.19.0, =0.17.0, =0.23.0, =0.17.0, =0.17.0, =0.17.1 - @choerodon/issue =0.17.0 and more Source cves: CVE-2021-23343 Source advisory: OSV:GHSA-HJ48-42VR-X3V9...
CVE-2021-3664
url-parse is vulnerable to URL Redirection to Untrusted Site...
CVE-2021-3664
url-parse is vulnerable to URL Redirection to Untrusted Site...
CVE-2021-3664
url-parse is vulnerable to URL Redirection to Untrusted Site...
CVE-2021-3664
url-parse is vulnerable to URL Redirection to Untrusted Site...
nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe
A flaw was found in nodejs-path-parse. All versions of package path-parse are vulnerable to Regular Expression Denial of Service ReDoS via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity...
0x-relayer-cat (>=0.0.3 <=0.0.10), @0x-klaytn/asset-swapper (>=4.2.1 <=4.2.2) +4506 more potentially affected by CVE-2021-27515 via url-parse (>=0.1.5 <=1.4.7)
url-parse NPM version =0.1.5, =0.0.3, =4.2.1, =2.1.0-beta.4, =5.0.0-beta, =0.1.0-beta.2, =0.0.1, =0.0.31, =0.0.1, =1.0.2, =0.1.0, =0.1.0, =1.6.1, =0.2.0, =1.0.3, =2.1.1 and more Source cves: CVE-2021-27515 Source advisory: OSV:GHSA-9M6J-FCG5-2442...
npm path-parse 安全漏洞
npm path-parse is an application plugin from the United States npm. It provides a path-parse function. A security vulnerability exists in path-parse, which originates from a Regular Expression Denial of Service ReDoS attack via the splitDeviceRe, splitTailRe, and splitPathRe regular expressions...
