7410 matches found
ots:ots-fuzzer: Use-of-uninitialized-value in ots::OpenTypeGVAR::Parse
Project: https://github.com/khaledhosny/ots.git Detailed Report: https://oss-fuzz.com/testcase?key=5742168799707136 Project: ots Fuzzing Engine: libFuzzer Fuzz Target: ots-fuzzer Job Type: libfuzzermsanots Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...
Information Disclosure
parse is vulnerable to information disclosure. The setPassword function stores the user's password in localStorage as raw text, allowing a user to access the localStorage and obtain the password...
Storing Password in Local Storage
The setPassword method http://parseplatform.org/Parse-SDK-JS/api/2.9.1/Parse.User.htmlsetPassword stores the user's password in localStorage as raw text making it vulnerable to anyone with access to your localStorage. We believe this is the only time that password is stored at all. In the...
@0x18b2ee/parse-server (>=3.10.1, <=3.11.0), @adncorp/parse-server (>=2.0.0, <=2.10.4) +24 more potentially affected by unknown CVE via parse (>=2.0.1, <=2.8.0)
parse NPM version =2.0.1, =3.10.1, =2.0.0, =0.0.7, =1.0.5, =4.3.0-fast-roles, =4.3.0, =1.0.9, =1.0.0, =3.1.1, =3.10.0, =3.1.3, =3.1.6 - nex-parse-server 4.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-WVH7-5P38-2QFC...
GHSA-WVH7-5P38-2QFC Storing Password in Local Storage
The setPassword method http://parseplatform.org/Parse-SDK-JS/api/2.9.1/Parse.User.htmlsetPassword stores the user's password in localStorage as raw text making it vulnerable to anyone with access to your localStorage. We believe this is the only time that password is stored at all. In the...
Authorization Bypass
parse-server is vulnerable to authorization bypass. The vulnerability exists in the GraphQL viewer where an authenticated user can bypass the read security restrictions, and all objects linked through relation, placed on his User object...
GraphQL: Security breach on Viewer query
Impact An authenticated user using the viewer GraphQL query can bypass all read security on his User object and can also bypass all objects linked via relation or Pointer on his User object. Patches This vulnerability has been patched in Parse Server 4.3.0. Workarounds No References See commit...
@bigegg/parse-server-schema-config (>=1.0.5, <=1.0.10), sails-hook-parse-server (>=1.0.0, <=1.1.0) potentially affected by CVE-2020-15126 via parse-server (3.10.0)
parse-server NPM version 3.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on parse-server and may be impacted: - @bigegg/parse-server-schema-config =1.0.5, =1.0.0, =1.1.0 Source cves: CVE-2020-15126 Source advisory: OSV:GHSA-236H-RQV8-8Q73...
GHSA-236H-RQV8-8Q73 GraphQL: Security breach on Viewer query
Impact An authenticated user using the viewer GraphQL query can bypass all read security on his User object and can also bypass all objects linked via relation or Pointer on his User object. Patches This vulnerability has been patched in Parse Server 4.3.0. Workarounds No References See commit...
OSV-2020-1165 Global-buffer-overflow in parse_headers
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14154 Crash type: Global-buffer-overflow READ 4 Crash state: parseheaders parsehttprequest fuzzparsehttprequest...
OSV-2020-855 Use-of-uninitialized-value in read_uleb128
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6402 Crash type: Use-of-uninitialized-value Crash state: readuleb128 dexparse dexload...
Huawei Data Communication: Read and parse display mpls ldp session verbose
Get mpls ldp session configuration of the VRP device. Please set screen-length of user-interface to 0, otherwise not all configurations are returned. Note: This script only stores information for other Policy Controls. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be...
Huawei Data Communication: Read and parse display mpls rsvp-te interface
Get mpls rsvp-te interface configuration of the VRP device. Please set screen-length of user-interface to 0, otherwise not all configurations are returned. Note: This script only stores information for other Policy Controls. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might b...
CVE-2020-12425
Due to confusion processing a hyphen character in Date.parse, a one-byte out of bounds read could have occurred, leading to potential information disclosure. This vulnerability affects Firefox 78...
The vulnerability of the phar_parse_pharfile function (xt/phar/phar.c) in the PHP programming language allows a malicious actor to gain unauthorized access to protected information.
The vulnerability of the pharparsepharfile function xt/phar/phar.c in the PHP programming language involves reading beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
gettext: double free in default_add_message in read-catalog.c
An issue was discovered in GNU gettext 0.19.8. There is a double free in defaultaddmessage in read-catalog.c, related to an invalid free in pogramparse in po-gram-gen.y, as demonstrated by lt-msgfmt...
UBUNTU-CVE-2020-15570
The parsereport function in whoopsie.c in Whoopsie through 0.2.69 mishandles memory allocation failures, which allows an attacker to cause a denial of service via a malformed crash file...
Mozilla Firefox Buffer Overflow Vulnerability (CNVD-2020-44565)
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A buffer overflow vulnerability exists in Date.parse in versions prior to Mozilla Firefox 78. An attacker can exploit this vulnerability to obtain sensitive information...
Ntop nDPI Buffer Overflow Vulnerability (CNVD-2020-36698)
Ntop nDPI is an open source library for deep packet inspection from Ntop Italy. A buffer overflow vulnerability exists in the ndpiparsepacketlineinfo in the lib/ndpimain.c file in Ntop nDPI 3.2 and earlier versions. The vulnerability stems from a network system or product performing operations in...