PT-2022-24823 · Unknown · Parse Server

Name of the Vulnerable Software and Affected Versions: Parse Server versions prior to 4.10.15 Parse Server versions 5.0.0 through 5.2.5 Description: A user can write to the session object of another user if the session object ID is known. For example, an attacker can assign the session object to...

nodejs-ini: Prototype pollution via malicious INI file

A flaw was found in nodejs-ini. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context...

CVE-2022-37032

An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service. This occurs in bgpcapabilitymsgparse in bgpd/bgppacket.c...

UBUNTU-CVE-2022-37032

An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service. This occurs in bgpcapabilitymsgparse in bgpd/bgppacket.c...

janino:ExpressionEvaluatorFuzzer: Security exception in org.codehaus.janino.Parser.parseAssignmentExpression

Project: https://github.com/janino-compiler/janino.git Detailed Report: https://oss-fuzz.com/testcase?key=5724625576787968 Project: janino Fuzzing Engine: libFuzzer Fuzz Target: ExpressionEvaluatorFuzzer Job Type: libfuzzerasanjanino Platform Id: linux Crash Type: Security exception Crash Address...

PT-2022-37287 · Git +1 · Bluez

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 4 crash has been reported. The crash involves the following functions: element end, emit end element, and g markup parse...

PT-2022-34397

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.256 Description The issue is related to a refcount leak in the qcom smd parse edge function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions pri...

PT-2022-34265 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.211 Description: A refcount leak was discovered in the qcom smd parse edge function of the rpmsg: qcom smd module. The actual impact and attack plausibility of this issue have not yet been proven...

PT-2022-33828 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 4.9 through 5.15.60 Description: The issue is related to a refcount leak in the qcom smd parse edge function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2022-34549

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.326 Description The issue is related to the initialization of jump labels before the parse early param function is called. The actual impact and potential for attack have not been proven yet. Recommendations...

PT-2022-34461

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.291 Description The issue is related to the initialization of jump labels before the parse early param function is called. The actual impact and potential for attack have not been proven yet. Recommendation...

PT-2022-34348

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.256 Description The issue is related to the initialization of jump labels before the parse early param function is called. The actual impact and potential for attack have not been proven yet. Recommendation...

PT-2022-34282

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 5.4.132 through 5.4.210 Description A refcount leak was discovered in the parse redboot of function related to mtd partitions. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

GHSA-2M6G-CRV8-P3C6 Parse Server vulnerable to brute force guessing of user sensitive data via search patterns

Impact Internal fields keys used internally by Parse Server, prefixed by and protected fields user defined can be used as query constraints. Internal and protected fields are removed by Parse Server from query results and are only returned to the client using a valid master key. However, using...

Parse Server vulnerable to brute force guessing of user sensitive data via search patterns

Impact Internal fields keys used internally by Parse Server, prefixed by and protected fields user defined can be used as query constraints. Internal and protected fields are removed by Parse Server from query results and are only returned to the client using a valid master key. However, using...

DEBIAN-CVE-2022-40149

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

GHSA-PQW5-JMP5-PX4V parse-url parses http URLs incorrectly, making it vulnerable to host name spoofing

parse-url prior to 8.1.0 is vulnerable to Misinterpretation of Input. parse-url parses certain http or https URLs incorrectly, identifying the URL's protocol as ssh. It may also parse the host name incorrectly...

parse-url parses http URLs incorrectly, making it vulnerable to host name spoofing

parse-url prior to 8.1.0 is vulnerable to Misinterpretation of Input. parse-url parses certain http or https URLs incorrectly, identifying the URL's protocol as ssh. It may also parse the host name incorrectly...

pasbeaucoupmoinsrave (0.2.0) potentially affected by CVE-2022-3224 via parse-url (8.0.0)

parse-url NPM version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on parse-url and may be impacted: - pasbeaucoupmoinsrave 0.2.0 Source cves: CVE-2022-3224 Source advisory: OSV:GHSA-PQW5-JMP5-PX4V...

PT-2022-33419 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.4 Description: A NULL pointer dereference issue exists in the dev parse header protocol function when skb-dev is null. This issue was introduced in version v5.12 and is fixed in Linux Kernel version v5.19....