9158 matches found
EulerOS 2.0 SP10 : golang (EulerOS-SA-2022-2683)
According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request...
CVE-2022-3809 Axiomatic Bento4 mp4tag Mp4Tag.cpp ParseCommandLine denial of service
A vulnerability was found in Axiomatic Bento4 and classified as problematic. Affected by this issue is the function ParseCommandLine of the file Mp4Tag/Mp4Tag.cpp of the component mp4tag. The manipulation leads to denial of service. The attack may be launched remotely. The exploit has been...
PT-2022-24196
Name of the Vulnerable Software and Affected Versions Axiomatic Bento4 affected versions not specified Description A problematic issue was found, affecting the ParseCommandLine function of the Mp4Tag/Mp4Tag.cpp file in the mp4tag component. This issue leads to denial of service and can be exploit...
OSV-2022-1118 Security exception in java.base/jdk.internal.math.FloatingDecimal.readJavaFormatString
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52840 Crash type: Security exception Crash state: java.base/jdk.internal.math.FloatingDecimal.readJavaFormatString java.base/jdk.internal.math.FloatingDecimal.parseDouble java.base/java.lang.Double.parseDouble...
PT-2022-36722 · Git +1 · Radare2
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 1 crash has been reported. The crash involves the functions parse classes 64, classes, and r bin object set items. No...
PT-2022-5322 · Nginx · Nginx Njs
Name of the Vulnerable Software and Affected Versions: Nginx NJS version 0.7.2 Description: The issue is related to a heap-use-after-free bug caused by an illegal memory copy in the njs json parse iterator call function at njs json.c. This bug can be exploited by a remote attacker to execute...
Nginx 资源管理错误漏洞
Nginx is a lightweight web server/reverse proxy server and email IMAP/POP3 proxy server from Nginx, Inc. njs is one of the scripting language components that supports extended NGINX functionality. A security vulnerability exists in Nginx NJS version 0.7.2, which stems from heap-based...
CVE-2022-25849 Cross-site Scripting (XSS)
The package joyqi/hyper-down from 0.0.0 are vulnerable to Cross-site Scripting XSS because the module of parse markdown does not filter the href attribute very well...
CVE-2022-25849 Cross-site Scripting (XSS)
The package joyqi/hyper-down from 0.0.0 are vulnerable to Cross-site Scripting XSS because the module of parse markdown does not filter the href attribute very well...
CVE-2022-25849
The package joyqi/hyper-down from 0.0.0 are vulnerable to Cross-site Scripting XSS because the module of parse markdown does not filter the href attribute very well...
CVE-2022-25849
CVE-2022-25849 affects joyqi/hyper-down, a Markdown parser library. The vulnerability stems from improper filtering of href attributes in the markdown parser, enabling cross-site scripting (XSS). Affected versions start at 0.0.0 and continue thereafter. Public details describe an XSS vector in th...
golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension
A flaw was found in golang.org. In x/text, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension...
golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag
A flaw was found in golang.org. In x/text, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag...
Denial Of Service (DoS)
parse-server is vulnerable to denial of service. The vulnerability exists in multiple functions due to user inputs not properly validated which allows an attacker to send a file download request with an invalid byte range causing an application crash...
CVE-2022-39313
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.17, and prior to 5.2.8 on the 5.x branch, crash when a file download request is received with an invalid byte range, resulting in a Denial of Service. This issue has been...
Design/Logic Flaw
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.17, and prior to 5.2.8 on the 5.x branch, crash when a file download request is received with an invalid byte range, resulting in a Denial of Service. This issue has been...
caddy:fuzz-parse-network-address: Null-dereference READ in pthread_create
Detailed Report: https://oss-fuzz.com/testcase?key=5993421445922816 Project: caddy Fuzzing Engine: libFuzzer Fuzz Target: fuzz-parse-network-address Job Type: libfuzzerasancaddy Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate...
CVE-2022-39313 Parse Server crashes when receiving file download request with invalid byte range
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.17, and prior to 5.2.8 on the 5.x branch, crash when a file download request is received with an invalid byte range, resulting in a Denial of Service. This issue has been...
PT-2022-36702
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a stack-buffer-overflow read error. The crash state involves several functions: authentic parse size, authentic get tagged data, an...
CVE-2022-39313 Parse Server crashes when receiving file download request with invalid byte range
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.17, and prior to 5.2.8 on the 5.x branch, crash when a file download request is received with an invalid byte range, resulting in a Denial of Service. This issue has been...