@antv/chart-linter (>=1.1.5, <=1.1.6), @dljsbook/data (>=0.3.2, <=0.6.1) +59 more potentially affected by CVE-2019-10806 via vega-util (>=1.1.4, <=1.12.2)

vega-util NPM version =1.1.4, =1.1.5, =0.3.2, =0.6.0, =0.0.4, =1.0.0, =0.8.0, =1.0.0-alpha.4, =0.0.0-placeholder, =0.2.4-beta.1, =0.4.3-dev10, =1.0.0, =1.4.0, =5.0.0, =6.0.2-alpha.0 and more Source cves: CVE-2019-10806 Source advisory: OSV:GHSA-6HWH-RQWF-CXXR...

@acanto/october-scripts (3.2.2), @acanto/workflow (5.1.0) +333 more potentially affected by CVE-2020-7733 via ua-parser-js (>=0.6.2, <=0.7.21)

ua-parser-js NPM version =0.6.2, =0.16.9, =2018.7.11-0, =2.0.1, =1.0.0-beta.11, =2.0.0-beta.1, =1.0.0, =5.0.0, =2.6.6, =6.6.0, =3.0.1, =0.1.3, =0.3.8 - @chessboard/nwb 0.25.3-next.0 and more Source cves: CVE-2020-7733 Source advisory: OSV:GHSA-662X-FHQG-9P8V...

OpenEXR DwaCompressor Heap Buffer Overflow Vulnerability

OpenEXR is an image file format for high dynamic range HDR images. a heap buffer overflow vulnerability exists in OpenEXR DwaCompressor. An attacker could exploit this vulnerability to cause a program crash using an application compiled with OpenEXR...

@random-guys/coralpay-pgp (>=0.0.1, <=0.1.0), @woocommerce/components (>=1.0.0, <=1.0.1) +4 more potentially affected by CVE-2020-7719 via locutus (>=2.0.10, <=2.0.11)

locutus NPM version =2.0.10, =0.0.1, =1.0.0, =1.1.0, =1.0.2, =1.0.52, =0.1.0, =0.2.1 Source cves: CVE-2020-7719 Source advisory: OSV:GHSA-F98M-Q3HR-P5WQ...

UBUNTU-CVE-2019-25043

ModSecurity 3.x before 3.0.4 mishandles key-value pair parsing, as demonstrated by a "string index out of range" error and worker-process crash for a "Cookie: =abc" header...

GHSA-CF4H-3JHX-XVHQ Arbitrary Code Execution in underscore

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Execution via the template function, particularly when a variable property is passed as an argument as it is not sanitized...

CVE-2021-22208

An issue has been discovered in GitLab affecting versions starting with 13.5 up to 13.9.7. Improper permission check could allow the change of timestamp for issue creation or update...

OESA-2021-1177 nettle security update

Nettle is a cryptographic library designed to fit any context: in crypto toolkits for object-oriented languages, in applications like LSH or GnuPG, or even in kernel space. Security Fixes: A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions...

OESA-2021-1148 ImageMagick security update

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats over 200 including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images,...

Fortinet FortiNAC 权限许可和访问控制问题漏洞

Fortinet FortiNAC is a set of network access control solutions from the U.S. company Fita Fortinet. The product is primarily used for network access control and IoT security. FortiNAC suffers from a privilege permission and access control issue vulnerability that arises from an application not...

Industrial Light and Magic OpenEXR 资源管理错误漏洞

OpenEXR is an image file format for high dynamic range HDR images.A heap buffer overflow vulnerability exists in OpenEXR DwaCompressor, which can be exploited by attackers to crash applications compiled using OpenEXR...

PT-2021-4074 · Unknown +1 · Mod Auth Openidc +1

Name of the Vulnerable Software and Affected Versions: mod auth openidc versions 2.4.0 through 2.4.7 Description: The issue is related to an uncontrolled consumption of resources, which can be exploited by a remote attacker to cause a denial-of-service DoS condition. The exact vectors used for th...

EulerOS 2.0 SP3 : wpa_supplicant (EulerOS-SA-2021-1860)

According to the versions of the wpasupplicant package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A vulnerability was discovered in how p2p/p2ppd.c in wpasupplicant before 2.10 processes P2P Wi-Fi Direct provision discovery requests. It...

“BadAlloc” – Memory allocation vulnerabilities could affect wide range of IoT and OT devices in industrial, medical, and enterprise networks

Microsoft’s Section 52, the Azure Defender for IoT security research group, recently uncovered a series of critical memory allocation vulnerabilities in IoT and OT devices that adversaries could exploit to bypass security controls in order to execute malicious code or cause a system crash. These...

F5 BIG-IP 代码注入漏洞

F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, load balancing, and other features from F5 USA. A code injection vulnerability exists in BIG-IP, which is caused by improper resource management within TMM. The following...

SUSE SLED15 / SLES15 Security Update : libnettle (SUSE-SU-2021:1412-1)

This update for libnettle fixes the following issues : CVE-2021-20305: Fixed the multiply function which was being called with out-of-range scalars bsc1184401. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has...

SUSE-SU-2021:1412-1 Security update for libnettle

This update for libnettle fixes the following issues: - CVE-2021-20305: Fixed the multiply function which was being called with out-of-range scalars bsc1184401...

SUSE-SU-2021:1399-1 Security update for libnettle

This update for libnettle fixes the following issues: - CVE-2021-20305: Fixed the multiply function which was being called with out-of-range scalars bsc1184401, bsc1183835...

PT-2021-15464 · Unknown · Browserslist

Name of the Vulnerable Software and Affected Versions: browserslist versions 4.0.0 through 4.16.5 Description: The issue concerns a Regular Expression Denial of Service ReDoS that occurs during the parsing of queries. Recommendations: For versions 4.0.0 through 4.16.5, update to a version after...

browserslist 安全漏洞

browserslist is a software application. It is used to share the configuration of target browsers and Node.js versions between different front-end tools. A security vulnerability exists in browserslist from version 4.0.0 to 4.16.5, which stems from vulnerability to regular expression denial of...