7406 matches found
GHSA-P6H4-93QP-JHCM Command injection in Parse Server through prototype pollution
Impact This is a Remote Code Execution RCE vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that leads to RCE is the Prototype Pollution vulnerable code in the file DatabaseController.js, so it is likely to affect...
Command injection in Parse Server through prototype pollution
Impact This is a Remote Code Execution RCE vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that leads to RCE is the Prototype Pollution vulnerable code in the file DatabaseController.js, so it is likely to affect...
hostname spoofing via Improper Input Validation
Description When to use the parse-url, If user put the https://google.comhashvalue as argument, parse-url doesn't parse the hash value and parses hostname and hash together as hostname. http://localhost/hashvalue and http://localhosthashvalue are the same.. txt - new URL of node ❯ node -e...
PT-2022-16862 · Microsoft +1 · Windows +1
Name of the Vulnerable Software and Affected Versions: Parse Server versions prior to 4.10.7 Description: The issue is a Remote Code Execution RCE vulnerability in Parse Server, affecting the default configuration with MongoDB. The main weakness is the Prototype Pollution vulnerable code in the...
UBUNTU-CVE-2021-32435
Stack-based buffer overflow in the function getkey in parse.c of abcm2ps v8.14.11 allows remote attackers to cause a Denial of Service DoS via unspecified vectors...
dotnet: double parser stack buffer overrun
A flaw was found in dotnet, where a buffer overrun exists in the double parse routine, which could lead to remote code execution. This flaw allows an attacker to execute code remotely on the system, leading to some system compromise...
dotnet: double parser stack buffer overrun
A flaw was found in dotnet, where a buffer overrun exists in the double parse routine, which could lead to remote code execution. This flaw allows an attacker to execute code remotely on the system, leading to some system compromise...
dotnet: double parser stack buffer overrun
A flaw was found in dotnet, where a buffer overrun exists in the double parse routine, which could lead to remote code execution. This flaw allows an attacker to execute code remotely on the system, leading to some system compromise...
dotnet: double parser stack buffer overrun
A flaw was found in dotnet, where a buffer overrun exists in the double parse routine, which could lead to remote code execution. This flaw allows an attacker to execute code remotely on the system, leading to some system compromise...
Open Redirect
Description parse-url parses the url as https://google.com::/test, and if two or more colons are inserted in the port part, the port is parsed as one hostname. txt - node - url.parse ❯ node -e 'console.logrequire"url".parse"https://google.com::/test"' Url protocol: 'https:', slashes: true, auth:...
Google Android 缓冲区错误漏洞
Google Android is a Linux-based open source operating system from Google, Inc. A buffer overflow vulnerability exists in Google Android due to an out-of-bounds read in cdParseMsg of cdcodec.c caused by a boundary check error, which could be exploited to cause remote information disclosure...
UBUNTU-CVE-2022-26129
Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the subtlv length in the functions, parsehellosubtlv, parseihusubtlv, and parseupdatesubtlv in babeld/message.c...
PT-2022-16831 · Uri.Js · Uri.Js
Name of the Vulnerable Software and Affected Versions: URI.js versions prior to 1.19.9 Description: The issue arises from whitespace characters not being removed from the beginning of the protocol, resulting in improper URL parsing. This can cause protocol validation mechanisms to fail. The probl...
PT-2022-4363 · Frrouting +3 · Frrouting +3
Name of the Vulnerable Software and Affected Versions: FRRouting versions through 8.1.0 Description: The issue is related to buffer overflow vulnerabilities due to incorrect checks on the subtlv length in the functions parse hello subtlv, parse ihu subtlv, and parse update subtlv in...
CVE-2021-23206
A flaw was found in htmldoc in v1.9.12 and prior. A stack buffer overflow in parsetable in ps-pdf.cxx may lead to execute arbitrary code and denial of service...
DEBIAN-CVE-2021-23206
A flaw was found in htmldoc in v1.9.12 and prior. A stack buffer overflow in parsetable in ps-pdf.cxx may lead to execute arbitrary code and denial of service...
CVE-2022-0691
An authorization bypass flaw was found in url-parse. This flaw allows a local unauthenticated attacker to add a backspace character \b while submitting a URL. This vulnerability can enable bypassing any hostname checks...
CVE-2022-0686
An authorization bypass flaw was found in url-parse. While submitting a URL, a local unauthenticated attacker can add a trailing colon :, but omit the port number. This issue enables an open redirect that allows the exposure of sensitive information or spamming of infrastructure outside the...
ruby: Cookie prefix spoofing in CGI::Cookie.parse
A flaw was found in Ruby. RubyGems cgi gem could allow a remote attacker to conduct spoofing attacks caused by the mishandling of security prefixes in cookie names in the CGI::Cookie.parse function. By sending a specially-crafted request, an attacker could perform cookie prefix spoofing attacks...