duckdb:parse_fuzz_test: Stack-buffer-overflow in bool duckdb::TryCast::Operation<duckdb::string_t, int>

Detailed Report: https://oss-fuzz.com/testcase?key=5746250188718080 Project: duckdb Fuzzing Engine: afl Fuzz Target: parsefuzztest Job Type: aflasanduckdb Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash Address: 0x7ffc3d9e0050 Crash State: bool duckdb::TryCast::Operation int...

GHSA-3448-VRGH-85XR NULL Pointer Dereference in OpenCV.

An issue was discovered in OpenCV before 4.1.1 OpenCV-Python before 4.1.1.26. There is a NULL pointer dereference in the function cv::XMLParser::parse at modules/core/src/persistence.cpp...

DEBIAN-CVE-2020-22679

Memory leak in the sgpdparseentry function in MP4Box in gpac 0.8.0 allows attackers to cause a denial of service DoS via a crafted input...

DEBIAN-CVE-2020-22673

Memory leak in the sencParse function in MP4Box in gpac 0.8.0 allows attackers to cause a denial of service DoS via a crafted input...

PT-2021-4366

Name of the Vulnerable Software and Affected Versions llhttp versions prior to 2.1.4 llhttp versions prior to 6.0.6 Description The issue is related to the parse function in llhttp, which ignores chunk extensions when parsing the body of chunked requests. This can lead to HTTP Request Smuggling H...

PT-2021-10776

Name of the Vulnerable Software and Affected Versions gpac version 0.8.0 Description A memory leak in the senc Parse function in MP4Box allows attackers to cause a denial of service DoS via a crafted input. Recommendations For gpac version 0.8.0, at the moment, there is no information about a new...

PT-2021-10781

Name of the Vulnerable Software and Affected Versions gpac version 0.8.0 Description The issue is related to a memory leak in the sgpd parse entry function in MP4Box, which allows attackers to cause a denial of service DoS via a crafted input. Recommendations For gpac version 0.8.0, consider...

javaparser:parseFuzzer: Uncaught exception in com.github.javaparser.ast.expr.BinaryExpr.accept

Project: https://github.com/javaparser/javaparser.git Detailed Report: https://oss-fuzz.com/testcase?key=5530030613069824 Project: javaparser Fuzzing Engine: libFuzzer Fuzz Target: parseFuzzer Job Type: libfuzzerasanjavaparser Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash...

PT-2021-23407

Name of the Vulnerable Software and Affected Versions Open5GS versions 1.0.0 through 2.3.3 Description The issue arises from the ogs fqdn parse function in Open5GS, which inappropriately trusts a client-supplied length value. This leads to a buffer overflow when an attacker sends a PFCP Session...

GO-2021-0113 Out-of-bounds read in golang.org/x/text/language

Due to improper index calculation, an incorrectly formatted language tag can cause Parse to panic via an out of bounds read. If Parse is used to process untrusted user inputs, this may be used as a vector for a denial of service attack...

CVE-2021-0690

In ih264dmarkerrsliceskip of ih264dparsepslice.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-9...

PT-2021-7944

Name of the Vulnerable Software and Affected Versions golang.org/x/text versions prior to 0.3.7 Description The issue is related to a denial-of-service attack that can occur due to an out-of-bounds read during BCP 47 language tag parsing. This happens because of mishandled index calculation. If...

LiveQuery publishes user session tokens in parse-server

Impact For regular non-LiveQuery queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the Parse.User class, all session tokens created during user sign-ups will be broadcast as part of the LiveQuery...

GHSA-7PR3-P5FM-8R9X LiveQuery publishes user session tokens in parse-server

Impact For regular non-LiveQuery queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the Parse.User class, all session tokens created during user sign-ups will be broadcast as part of the LiveQuery...

CVE-2021-41109

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular non-LiveQuery queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscriptio...

CVE-2021-41109

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular non-LiveQuery queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscriptio...

Session fixation

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular non-LiveQuery queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscriptio...

CVE-2021-41109

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular non-LiveQuery queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscriptio...

CVE-2021-41109 LiveQuery publishes user session tokens

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular non-LiveQuery queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscriptio...

CVE-2021-41109

CVE-2021-41109 refers to a vulnerability in Parse Server where, before version 4.10.4, LiveQuery payloads leaked session tokens for users with a LiveQuery subscription on the Parse.User class. The root cause is that LiveQuery payloads included session tokens while regular queries did not. The adv...