Design/Logic Flaw

This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn mixes objects into the target object, recursively mixing existing child objects as well. In both cases, the key used to access the target object recursively...

CVE-2022-21213 Prototype Pollution

This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn mixes objects into the target object, recursively mixing existing child objects as well. In both cases, the key used to access the target object recursively...

CVE-2022-21213

This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn mixes objects into the target object, recursively mixing existing child objects as well. In both cases, the key used to access the target object recursively...

Mout 安全漏洞

Mout is a Javascript-based codebase from the Mout team that provides modular support for JS programming. A security vulnerability exists in Mout, which stems from the fact that the deepFillIn function used to "fill missing properties recursively" while deepMixIn mixes objects into the target obje...

DOMDig - DOM XSS Scanner For Single Page Applications

DOMDig is a DOM XSS scanner that runs inside the Chromium web browser and it can scan single page applications SPA recursively. Unlike other scanners, DOMDig can crawl any webapplication including gmail by keeping track of DOM modifications and XHR/fetch/websocket requests and it can simulate a...

Security Bulletin: IBM Jazz for Service Management is vulnerable to a Apache Log4j vulnerabilities(CVE-2021-45105, CVE-2021-45046)

Summary Based on current information and analysis, IBM Jazz for Service Management does not use Apache log4j-core library which is vulnerable to CVE-2021-45105, CVE-2021-45046 . However, IBM Jazz for Service Management may be impacted because the old version of Log4j-1.2-api and Log4j-api are use...

XML External Entity (XXE)

xmlbeans is vulnerable to XML External Entity attacks. The vulnerability exists due to the lack of sanitization of XML input containing a reference to an external entity which is processed by a weakly configured XML parser allowing an attacker to exhaust the system resource via recursive external...

EulerOS 2.0 SP3 : zsh (EulerOS-SA-2022-1778)

According to the versions of the zsh package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. Th...

Infinite recursive function calls result in stack overflow

Description When providing certain input, the program will enter an infinite loop where it continually calls: getexprregister - cmdlinehandlebackslashkey - getcmdline - getcmdlineint - cmdlinehandlebackslashkey - getexprregister - etc. GDB shell Thread debugging using libthreaddb enabled Using ho...

GHSA-23H9-M55M-C5JP Jenkins Token Macro Plugin's recursive token expansion results in information disclosure and DoS

Jenkins Token Macro Plugin recursively applied token expansion. This could be used by users able to affect input to token expansion such as change log messages, to inject additional tokens into the input, which would then be expanded, resulting in information disclosure for example values of...

Jenkins Token Macro Plugin's recursive token expansion results in information disclosure and DoS

Jenkins Token Macro Plugin recursively applied token expansion. This could be used by users able to affect input to token expansion such as change log messages, to inject additional tokens into the input, which would then be expanded, resulting in information disclosure for example values of...

GHSA-Q446-82VQ-W674 Improper Limitation of a Pathname to a Restricted Directory in JCraft JSch

Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ dot dot backslash in a response to a recursive GET command...

Improper Limitation of a Pathname to a Restricted Directory in JCraft JSch

Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ dot dot backslash in a response to a recursive GET command...

zsh: Prompt expansion vulnerability

A vulnerability was found in zsh in the parsecolorchar function of prompt.c file. This flaw allows an attacker to perform code execution if they control a command output inside the prompt, as stated by a %F%K argument. This occurs because of recursive PROMPTSUBST expansion...

Phabricator: Slowvote and Countdown can cause Denial of Service due to recursive inclusion

Similar to 85011, if you edit a Slowvote or Countdown object and include its own object ID in the description, then it will recursively include and prevent the page from loading. mongoose Impact Denial of Service. You can include the Slowvote or Countdown object on any other object to also preven...

xstream: Injecting highly recursive collections or maps can cause a DoS

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulatin...

The vulnerability of the Zend/zend_exceptions.c component of the PHP programming language interpreter allows a attacker to cause a service failure.

The vulnerability of the Zend/zendexceptions.c component of the PHP programming language interpreter exists due to insufficient checking of input data. Exploiting this vulnerability can allow an attacker to cause service failures through recursive calls to methods...

EulerOS 2.0 SP8 : zsh (EulerOS-SA-2022-1594)

According to the versions of the zsh package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. Th...

GSD-2022-1002199 drm/amdgpu: Fix recursive locking warning

drm/amdgpu: Fix recursive locking warning This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.189 by commit...

GSD-2022-1001729 drm/amdgpu: Fix recursive locking warning

drm/amdgpu: Fix recursive locking warning This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.34 by commit...