PT-2022-19434 · Charm · Charm

Name of the Vulnerable Software and Affected Versions: charm versions prior to 0.12.1 Description: A vulnerability allows attackers to forge HTTP requests to manipulate the charm data directory, potentially accessing or deleting anything on the server. Encrypted user data uploaded to the Charm...

CSV Injection

csv-safe is vulnerable to CSV injection. The library doesn't properly filter out special characters in str parameter which allows remote attackers to inject and execute malicious payloads on target system...

CSV-Safe improperly filters special characters potentially leading to CSV injection

CSV-Safe gem 3.0.0 doesn't filter out special characters which could trigger CSV Injection...

GHSA-F55G-X8QQ-2569 CSV-Safe improperly filters special characters potentially leading to CSV injection

CSV-Safe gem 3.0.0 doesn't filter out special characters which could trigger CSV Injection...

CSV-Safe improperly filters special characters potentially leading to CSV injection

CSV-Safe gem 3.0.0 doesn't filter out special characters which could trigger CSV Injection...

CVE-2022-28481

CSV-Safe gem 3.0.0 doesn't filter out special characters which could trigger CSV Injection...

CVE-2022-28481

CSV-Safe gem 3.0.0 doesn't filter out special characters which could trigger CSV Injection...

Input validation

CSV-Safe gem 3.0.0 doesn't filter out special characters which could trigger CSV Injection...

CVE-2022-28481

CSV-Safe gem 3.0.0 doesn't filter out special characters which could trigger CSV Injection...

CVE-2022-28481

CVE-2022-28481 affects the CSV-Safe Ruby gem prior to 3.0.0, which does not filter out characters that can trigger CSV/Formula Injection in exported CSV files. This is supported by multiple sources (e.g., Red Hat advisory, RubySec/RUBYGEMS notes, OSV/NVD records). Affected component: CSV-Safe gem...

CVE-2022-28481

CSV-Safe gem 3.0.0 doesn't filter out special characters which could trigger CSV Injection...

CVE-2022-28481

CSV-Safe gem 3.0.0 doesn't filter out special characters which could trigger CSV Injection...

CVE-2022-28481: Improper Neutralization of Formula Elements in a CSV File

CSV-Safe gem 3.0.0 doesn't filter out special characters which could trigger CSV Injection...

PT-2022-19054

Name of the Vulnerable Software and Affected Versions CSV-Safe gem versions prior to 3.0.0 Description The issue concerns the CSV-Safe gem, where versions prior to 3.0.0 fail to filter out special characters. This oversight could trigger CSV Injection, potentially leading to security issues...

You should use safe casts here

Judge @GalloDaSballo has assessed the 6th item in QA Report 254 as Medium risk. The relevant finding follows: … You should use safe casts here: depositspidmsg.sender.amount += uint192amount; depositspidmsg.sender.amount -= uint192amount; amount : uint192amount Otherwise, if token amounts are...

claimRewards() didnt follow the safe check effect pattern

Judge @GalloDaSballo has assessed the 2nd item in QA Report 230 as Medium risk. The relevant finding follows: … Impact a user can claim a reward by calling the claimRewards, however this function didnt follow the correct check effect pattern, where the zero address is set after making an external...

PT-2022-29278

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.3 Description The issue is related to a read out of bounds error in the LZ4 decompress safe partial function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

PT-2022-30446

Name of the Vulnerable Software and Affected Versions lz4 versions prior to v5.4.189 Description The issue is related to a read out of bounds error in the LZ4 decompress safe partial function. The actual impact and attack plausibility have not yet been proven. Recommendations For versions prior t...

PT-2022-29623

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.20 Description The issue is related to a read out of bounds error in the LZ4 decompress safe partial function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

PT-2022-30246

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.111 Description The issue is related to a read out of bounds error in the LZ4 decompress safe partial function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...