gdcm-security-poc

GDCM 发现 1-6：复现包 GDCM 中的六个解析器/编解码器缺陷，在 v3.2.6 上以 sanitizer 失败或有界传播检查的形式复现。每个自动触发都有一个接近有效的对照，不会产生易受攻击的信号。发现 1 还包含一个插桩的控制流原语。 供维护者和漏洞协调者审查。运行任何内容之前请阅读 SAFETY.md。 固定目标 manifest/targets.env： 名称| 修订| 说明 ---|---|--- vulnerable| 9c71b163| 标签 v3.2.6 master| 2cd05d13| 静态审查的上游 master 快照；运行时矩阵待定 fixed| 未设置|...

Improper Output Handling

Apache Log4j Core is vulnerable to Improper Output Handling. The vulnerability is due to XmlLayout failing to sanitize characters forbidden by the XML 1.0 specification, allowing log messages or MDC values to produce malformed XML or trigger exceptions during logging, which can lead to dropped or...

CVE-2022-34473

The HTML Sanitizer should have sanitized the href attribute of SVG use tags; however it incorrectly did not sanitize xlink:href attributes. This vulnerability affects Firefox 102...