GHSA-RRQV-VJRW-HRCR Arbitrary Code Execution in json-ptr

There is a security vulnerability in json-ptr versions prior to v2.1.0 in which an unscrupulous actor may execute arbitrary code. If your code sends un-sanitized user input to json-ptr's .get method, your project is vulnerable to this injection-style vulnerability...

@graphql-mesh/container (>=0.0.4-alpha-4e6432fb.0, <=0.0.62), @graphql-mesh/openapi (>=0.10.2, <=0.16.9) +13 more potentially affected by unknown CVE via json-ptr (2.0.0)

json-ptr NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on json-ptr and may be impacted: - @graphql-mesh/container =0.0.4-alpha-4e6432fb.0, =0.10.2, =0.5.2, =0.0.2, =0.6.0, =0.0.1, =0.0.2, =0.0.1, =0.0.2, =0.0.2, =0.0.2, =1.0.264,...

PT-2021-24459

Name of the Vulnerable Software and Affected Versions: json-ptr versions prior to 2.1.0 Description: The issue allows an unscrupulous actor to execute arbitrary code. This occurs when un-sanitized user input is sent to json-ptr's get method, making the project vulnerable to an injection-style...

ghostscript: use-after-free vulnerability in igc_reloc_struct_ptr() could result in DoS

A use-after-free flaw was found in igcrelocstructptr of psi/igc.c of Ghostscript-9.25. This flaw allows a local attacker to supply a specially crafted PDF file, causing a denial of service. The highest threat from this vulnerability is to system availability...

CVE-2020-27830

A vulnerability was found in Linux Kernel where in the spkttyioreceivebuf2 function, it would dereference spkttyiosynth without checking whether it is NULL or not, and may lead to a NULL-ptr deref crash...

Design/Logic Flaw

A vulnerability was found in Linux Kernel where in the spkttyioreceivebuf2 function, it would dereference spkttyiosynth without checking whether it is NULL or not, and may lead to a NULL-ptr deref crash...

CVE-2020-27830

A vulnerability was found in Linux Kernel where in the spkttyioreceivebuf2 function, it would dereference spkttyiosynth without checking whether it is NULL or not, and may lead to a NULL-ptr deref crash...

CVE-2020-27830

A vulnerability was found in Linux Kernel where in the spkttyioreceivebuf2 function, it would dereference spkttyiosynth without checking whether it is NULL or not, and may lead to a NULL-ptr deref crash...

CVE-2020-27830

A vulnerability was found in Linux Kernel where in the spkttyioreceivebuf2 function, it would dereference spkttyiosynth without checking whether it is NULL or not, and may lead to a NULL-ptr deref crash...

CVE-2020-27830

CVE-2020-27830 is a Linux Kernel vulnerability where spk_ttyio_receive_buf2() can dereference spk_ttyio_synth when it is NULL, causing a NULL-pointer dereference crash. The connected Nessus advisories (Unity Linux UTSA-2026-001485, UTSA-2026-004226, UTSA-2026-003925) reference this CVE as part of...

Arbitrary JavaScript Execution

Overview There is a security vulnerability in json-ptr versions prior to v2.1.0 in which an unscrupulous actor may execute arbitrary code. If your code sends un-sanitized user input to json-ptr's .get method, your project is vulnerable to this injection-style vulnerability. Recommendation Upgrade...

GHSA-X5R6-X823-9848 Arbitrary Code Execution in json-ptr

npm json-ptr before 2.1.0 has an arbitrary code execution vulnerability. The issue occurs in the set operation when the force flag is set to true. The function recursively set the property in the target object, however it does not properly check the key being set, leading to a prototype pollution...

@graphql-mesh/container (>=0.0.4-alpha-4e6432fb.0, <=0.0.62), @graphql-mesh/openapi (>=0.10.2, <=0.16.9) +13 more potentially affected by CVE-2020-7766 via json-ptr (2.0.0)

json-ptr NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on json-ptr and may be impacted: - @graphql-mesh/container =0.0.4-alpha-4e6432fb.0, =0.10.2, =0.5.2, =0.0.2, =0.6.0, =0.0.1, =0.0.2, =0.0.1, =0.0.2, =0.0.2, =0.0.2, =1.0.264,...

Arbitrary Code Execution in json-ptr

npm json-ptr before 2.1.0 has an arbitrary code execution vulnerability. The issue occurs in the set operation when the force flag is set to true. The function recursively set the property in the target object, however it does not properly check the key being set, leading to a prototype pollution...

PT-2021-28213

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-use-after-free READ 4 crash type. The crash state involves several functions: zend gc delref, zval delref p, and zval ptr...

DEBIAN-CVE-2020-27170

An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-f232326f6966. This...

CVE-2020-27170

An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-f232326f6966. This...

move_elements can double-free objects on panic

Affected versions of scratchpad used ptr::read to read elements while calling a user provided function f on them. Since the pointer read duplicates ownership, a panic inside the user provided f function could cause a double free when unwinding. The flaw was fixed in commit 891561bea by removing t...

RUSTSEC-2021-0030 move_elements can double-free objects on panic

Affected versions of scratchpad used ptr::read to read elements while calling a user provided function f on them. Since the pointer read duplicates ownership, a panic inside the user provided f function could cause a double free when unwinding. The flaw was fixed in commit 891561bea by removing t...

WS-2021-0031

Affected versions of scratchpad used ptr::read to read elements while calling a user provided function f on them. Since the pointer read duplicates ownership, a panic inside the user provided f function could cause a double free when unwinding. The flaw was fixed in version 1.3.1 by removing the...