Lucene search
+L

7421 matches found

NVD
NVD
added 2018/08/12 10:29 p.m.47 views

CVE-2018-3774

Incorrect parsing in url-parse 1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol...

10CVSS9.8AI score0.03805EPSS
SaveExploits0References3
CVE
CVE
added 2018/08/12 10:0 p.m.95 views

CVE-2018-3774

CVE-2018-3774 affects the url-parse library prior to 1.4.3 and stems from incorrect hostname parsing. This can enable SSRF, open redirect, and potential bypass of authentication in affected workflows that rely on url-parse for URL handling. Exploitation scenarios include misparsing hosts in URLs ...

10CVSS9.5AI score0.03805EPSS
SaveExploits0References3Affected Software1
Debian CVE
Debian CVE
added 2018/08/12 10:0 p.m.81 views

CVE-2018-3774

Incorrect parsing in url-parse 1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol...

10CVSS9.8AI score0.03805EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2018/08/12 12:0 a.m.5 views

PT-2018-16192 · Npm +2 · Url-Parse +2

Name of the Vulnerable Software and Affected Versions: url-parse versions prior to 1.4.3 Description: The issue is related to incorrect parsing in url-parse, which returns the wrong hostname. This can lead to multiple vulnerabilities, including Server Side Request Forgery SSRF, Open Redirect, and...

10CVSS6.4AI score0.03805EPSS
SaveExploits7References36
Github Security Blog
Github Security Blog
added 2018/08/06 9:37 p.m.35 views

Sandbox Breakout / Arbitrary Code Execution in static-eval

Affected versions of static-eval pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package. Proof of concept js var evaluate = require'static-eval'; var parse = require'esprima'.parse; va...

9.8CVSS9.4AI score0.03596EPSS
SaveExploits1References5Affected Software1
nodejs
nodejs
added 2018/08/02 3:2 p.m.594 views

Open Redirect

Overview Versions of url-parse before 1.4.3 returns the wrong hostname which could lead to Open Redirect, Server Side Request Forgery SSRF, or Bypass Authentication Protocol vulnerabilities. Recommendation Update to version 1.4.3 or later. References - HackerOne Report - GitHub Commit - GitHub...

7.5CVSS3.5AI score0.03805EPSS
SaveExploits0Affected Software1
OSV
OSV
added 2018/07/31 12:0 a.m.7 views

UBUNTU-CVE-2018-5813

An error within the "parseminolta" function dcraw/dcraw.c in LibRaw versions prior to 0.18.11 can be exploited to trigger an infinite loop via a specially crafted file...

6.5CVSS6.7AI score0.02088EPSS
SaveExploits0References4
OSV
OSV
added 2018/07/24 8:11 p.m.12 views

GHSA-Q75G-2496-MXPP Regular Expression Denial of Service in parsejson

Affected versions of parsejson are vulnerable to a regular expression denial of service when parsing untrusted user input. Recommendation The parsejson package has not been functionally updated since it was initially released. Additionally, it provides functionality which is natively included in...

7.5CVSS5.8AI score0.01508EPSS
SaveExploits1References4
OSV
OSV
added 2018/07/20 1:29 p.m.9 views

CVE-2018-14448

Codec::parse in track.cpp in Untrunc through 2018-06-07 has a NULL pointer dereference via a crafted MP4 file because of improper interaction with libav...

6.5CVSS5.8AI score0.01175EPSS
SaveExploits1References2
Prion
Prion
added 2018/07/20 1:29 p.m.19 views

Null pointer dereference

Codec::parse in track.cpp in Untrunc through 2018-06-07 has a NULL pointer dereference via a crafted MP4 file because of improper interaction with libav...

4.3CVSS6.4AI score0.01175EPSS
SaveExploits1References2Affected Software1
NVD
NVD
added 2018/07/20 1:29 p.m.25 views

CVE-2018-14448

Codec::parse in track.cpp in Untrunc through 2018-06-07 has a NULL pointer dereference via a crafted MP4 file because of improper interaction with libav...

6.5CVSS6.4AI score0.01175EPSS
SaveExploits1References2
Cvelist
Cvelist
added 2018/07/20 1:0 p.m.26 views

CVE-2018-14448

Codec::parse in track.cpp in Untrunc through 2018-06-07 has a NULL pointer dereference via a crafted MP4 file because of improper interaction with libav...

6.4AI score0.01175EPSS
SaveExploits1References2
CVE
CVE
added 2018/07/20 1:0 p.m.41 views

CVE-2018-14448

CVE-2018-14448 concerns the Untrunc project: a NULL pointer dereference in Codec::parse (track.cpp) when parsing a crafted MP4 file, caused by improper interaction with libav. This vulnerability affects Untrunc up to 2018-06-07 by design of the parser, and the issue is triggered during MP4 proces...

6.5CVSS6.4AI score0.01175EPSS
SaveExploits1References2Affected Software1
Hacker One
Hacker One
added 2018/07/19 9:49 a.m.74 views

Node.js third-party modules: url-parse package return wrong hostname

Jul 19th 2018 - lolwaleet submitted a report to Node.js third-party modules. I would like to report url-parse package return wrong hostname in url-parse. Module module name: url-parse version: 1.4.1 npm page: https://www.npmjs.com/package/url-parse Module Description The url-parse method exposes...

7.5CVSS0.2AI score0.03805EPSS
SaveExploits0
OSV
OSV
added 2018/07/12 8:29 p.m.7 views

UBUNTU-CVE-2018-14015

The sdbsetinternal function in sdb.c in radare2 2.7.0 allows remote attackers to cause a denial of service invalid read and application crash via a crafted ELF file because of missing input validation in rbindwarfparsecompunit in libr/bin/dwarf.c...

5.5CVSS6.1AI score0.01179EPSS
SaveExploits1References3
OSV
OSV
added 2018/07/10 6:29 p.m.7 views

DEBIAN-CVE-2018-13845

An issue has been found in HTSlib 1.8. It is a buffer over-read in samparse1 in sam.c...

9.8CVSS9.7AI score0.01646EPSS
SaveExploits0References1
OSV
OSV
added 2018/07/02 5:29 p.m.21 views

CVE-2018-13066

There is a memory leak in util/parser.c in libming 0.4.8, which will lead to a denial of service via parseSWFDEFINEBUTTON2, parseSWFDEFINEFONT, parseSWFDEFINEFONTINFO, parseSWFDEFINELOSSLESS, parseSWFDEFINESPRITE, parseSWFDEFINETEXT, parseSWFDOACTION, parseSWFFILLSTYLEARRAY, parseSWFFRAMELABEL,...

7.5CVSS7AI score
SaveExploits0References1
CNVD
CNVD
added 2018/06/28 12:0 a.m.41 views

Toppydo Input Validation Vulnerability

topdo is a to-do list management application. An input validation vulnerability exists in the 'ListFormatParser::parse' function in the topdo/lib/ListFormat.py file in topdo. The vulnerability can be exploited to inject arbitrary bytes into the endpoint with the help of a todo.txt file with one o...

8.1CVSS8AI score0.01165EPSS
SaveExploits0References1
NVD
NVD
added 2018/06/20 2:29 p.m.23 views

CVE-2018-12558

The parse method in the Email::Address module through 1.909 for Perl is vulnerable to Algorithmic complexity on specially prepared input, leading to Denial of Service. Prepared special input that caused this problem contained 30 form-field characters "\f"...

7.5CVSS7.4AI score0.0265EPSS
SaveExploits0References3
Prion
Prion
added 2018/06/20 2:29 p.m.26 views

Input validation

The parse method in the Email::Address module through 1.909 for Perl is vulnerable to Algorithmic complexity on specially prepared input, leading to Denial of Service. Prepared special input that caused this problem contained 30 form-field characters "\f"...

5CVSS7.4AI score0.0265EPSS
SaveExploits0References3
Rows per page
Query Builder