PT-2022-5387

Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.10.3 Description The issue is related to an integer overflow in the xmlParseNameComplex function of the libxml2 library when parsing XML documents with the XML PARSE HUGE parser option enabled. This can lead to an...

Cross site scripting in Elefant CMS

A vulnerability classified as problematic was found in Elefant CMS 1.3.12-RC. Affected by this vulnerability is an unknown functionality of the component Version Comparison. The manipulation leads to basic cross site scripting Persistent. The attack can be launched remotely. Upgrading to version...

WETH.allowance() returns wrong result.

Lines of code Vulnerability details Impact WETH.allowance returns wrong result. I can't find other contracts that use this function but WETH.sol is a base contract and it should be fixed properly. Proof of Concept In this function, the "return" keyword is missing and it will always output 0 in th...

Functions in CNote.sol are internal instead of external/public

Lines of code Vulnerability details Impact Most of the functions in CNote.sol are internal mutability and have no other locations they are being called. This renders most of the functionalities in the contract to be uncallable. Tools Used Manual review Recommended Mitigation Steps Change to the...

MAL-2022-6371 Malicious code in svgo-ruby (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 257abcb42a660a670b62862d4d341a46aad586177317711f9ff04dd75be63d62 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yarn-design-system-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36271b16949d7666fab1ad7ffc09c9fc82404a3383c2421567ead9f1b025a988 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in focal-manual-tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b8267c08beaf2784308f90736258ddb15871543675949db95be58e98520ddd2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @keybank/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5596b69540b481511f0af6a3fadb9075e18eafb8d43541e10ef85f2afdb9063 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in helix-rum-collector (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 002b86a6a7d367dc196dbac6c12dff9827ed2b0a483cb8520063a9f3e90c513b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2017-20064

Elefant CMS 1.3.12-RC contains a remote code-injection vulnerability in an unknown function of /designer/add/layout. The issue allows manipulation leading to code execution and is addressed by upgrading to version 1.3.13. Multiple connected sources corroborate the existence of the code-injection ...

CVE-2017-20064 Elefant CMS layout code injection

A vulnerability was found in Elefant CMS 1.3.12-RC. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /designer/add/layout. The manipulation leads to code injection. The attack can be launched remotely. Upgrading to version 1.3.13 is able to...

CVE-2017-20063 Elefant CMS File Upload drop privileges management

A vulnerability was found in Elefant CMS 1.3.12-RC. It has been classified as critical. Affected is an unknown function of the file /filemanager/upload/drop of the component File Upload. The manipulation leads to improper privilege management. It is possible to launch the attack remotely. Upgradi...

CVE-2017-20062 Elefant CMS cross-site request forgery

A vulnerability was found in Elefant CMS 1.3.12-RC and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to...

CVE-2017-20061 Elefant CMS extended Reflected cross site scriting

A vulnerability has been found in Elefant CMS 1.3.12-RC and classified as problematic. This vulnerability affects unknown code of the file /admin/extended. The manipulation of the argument name with the input %3Cimg%20src=no%20onerror=alert1%3E leads to basic cross site scripting Reflected. The...

CVE-2017-20060 Elefant CMS Blog Post Persistent cross site scriting

A vulnerability, which was classified as problematic, was found in Elefant CMS 1.3.12-RC. This affects an unknown part of the component Blog Post Handler. The manipulation leads to basic cross site scripting Persistent. It is possible to initiate the attack remotely. Upgrading to version 1.3.13 i...

CVE-2017-20059 Elefant CMS Title Persistent cross site scriting

A vulnerability, which was classified as problematic, has been found in Elefant CMS 1.3.12-RC. Affected by this issue is some unknown functionality of the component Title Handler. The manipulation with the input leads to basic cross site scripting Persistent. The attack may be launched remotely...

CVE-2017-20058 Elefant CMS Version Comparison Persistent cross site scriting

A vulnerability classified as problematic was found in Elefant CMS 1.3.12-RC. Affected by this vulnerability is an unknown functionality of the component Version Comparison. The manipulation leads to basic cross site scripting Persistent. The attack can be launched remotely. Upgrading to version...

CVE-2017-20057 Elefant CMS Persistent cross site scriting

A vulnerability classified as problematic has been found in Elefant CMS 1.3.12-RC. Affected is an unknown function. The manipulation of the argument username leads to basic cross site scripting Persistent. It is possible to launch the attack remotely. Upgrading to version 1.3.13 is able to addres...

PT-2022-20517 · Unknown · Parse Server

Name of the Vulnerable Software and Affected Versions: Parse Server versions prior to 4.10.12 Parse Server versions prior to 5.2.3 Description: The issue arises from the improper handling of certain types of invalid file requests, which can cause the server to crash. The availability impact may b...

UBUNTU-CVE-2014-125019

A vulnerability, which was classified as problematic, was found in FFmpeg 2.0. This affects the function decodenalunit of the component Slice Segment Handler. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. It is recommended to apply a patch to fix thi...