in stanfordnlp/corenlp

Description When a malicious schema XML file is passed to getValidatingXmlParser, the parser is vulnerable to XXE when the SchemaFactory parses the schema XML file. In...

RHEL 7 : rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon (RHSA-2022:0041)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0041 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...

nodejs-json-schema: Prototype pollution vulnerability

The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code...

UBUNTU-CVE-2021-45471

In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items...

nodejs-json-schema: Prototype pollution vulnerability

The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code...

Oracle Linux 8 : nodejs:16 (ELSA-2021-5171)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-5171 advisory. - Resolves CVE-2020-28469 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has...

RLSA-2021:5171 Moderate: nodejs:16 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 16.13.1, nodejs-nodemon 2.0.15. BZ2027610 Security Fixes: nodejs-json-schema:...

Fortinet FortiWeb Buffer Overflow Vulnerability (CNVD-2021-99680)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning, and other attacks to secure web applications and protect sensitive database content. A buffer overflow vulnerability exists, whi...

Fortinet FortiWeb Cross-Site Scripting Vulnerability (CNVD-2021-99662)

Fortinet FortiWeb is a Web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures Web applications and protects sensitive database content. A cross-site scripting vulnerability exists,...

Fortinet FortiWeb Command Injection Vulnerability (CNVD-2021-99770)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content.Fortinet FortiWeb A command injection...

Regular Expression Denial Of Service (ReDoS)

python-ldap is vulnerable to regular expression denial of service attacks. The vulnerability exists in ldap.schema package which allows an attacker to parse malicious strings to LDAP schema which causes a ReDoS attack...

GHSA-R8WQ-QRXC-HMCM ReDoS in LDAP schema parser

https://github.com/python-ldap/python-ldap/issues/424 Impact The LDAP schema parser of python-ldap 3.3.1 and earlier are vulnerable to a regular expression denial-of-service attack. The issue affects clients that use ldap.schema package to parse LDAP schema definitions from an untrusted source...

PT-2021-24339

Name of the Vulnerable Software and Affected Versions: python-ldap versions prior to 3.4.0 Description: The issue is related to a regular expression denial of service ReDoS flaw in the LDAP schema parser. By sending crafted regex input, a remote authenticated attacker could exploit this...

@1pedro/eslint-config (0.1.16), @2109-t5/server (>=1.0.0, <=1.0.9) +2524 more potentially affected by CVE-2021-3918 via json-schema (>=0.2.0, <=0.3.0)

json-schema NPM version =0.2.0, =1.0.0, =1.0.0, =0.1.0, =0.0.0-semantic-release, =14.0.0, =0.1.9, =0.1.9, =0.0.1, =0.0.1, =3.0.0-beta.3 and more Source cves: CVE-2021-3918 Source advisory: GHSA-896R-F27R-55MW...

GHSA-896R-F27R-55MW json-schema is vulnerable to Prototype Pollution

json-schema before version 0.4.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

@1pedro/eslint-config (0.1.16), @2109-t5/server (>=1.0.0, <=1.0.9) +2524 more potentially affected by CVE-2021-3918 via json-schema (>=0.2.0, <=0.3.0)

json-schema NPM version =0.2.0, =1.0.0, =1.0.0, =0.1.0, =0.0.0-semantic-release, =14.0.0, =0.1.9, =0.1.9, =0.0.1, =0.0.1, =3.0.0-beta.3 and more Source cves: CVE-2021-3918 Source advisory: OSV:GHSA-896R-F27R-55MW...

CVE-2021-3918

The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code...

rubygem-nokogiri: XML external entity injection via Nokogiri::XML::Schema

A flaw was found in Nokogiri. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XML External Entity XXE or Server-side request forgery SSRF attacks. The highest threat from this vulnerability is to...

json-schema has an unspecified vulnerability

json-schema is this is a historical repository of early development of the JSON Schema specification and implementation. json-schema suffers from a security vulnerability that stems from the vulnerability of json-schema to improper control of object prototype properties "prototype pollution". No...

Prototype Pollution

json-schema is vulnerable to prototype pollution. An attacker can inject properties into existing construct prototypes via the checkObj function in validate.js and modify attributes such as proto. and constructor...