@bigegg/parse-server-schema-config (>=1.0.5, <=1.0.10), sails-hook-parse-server (>=1.0.0, <=1.1.0) potentially affected by CVE-2020-15126 via parse-server (3.10.0)

parse-server NPM version 3.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on parse-server and may be impacted: - @bigegg/parse-server-schema-config =1.0.5, =1.0.0, =1.1.0 Source cves: CVE-2020-15126 Source advisory: OSV:GHSA-236H-RQV8-8Q73...

Unspecified Vulnerability in Oracle MySQL Server (CNVD-2020-41456)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in the Server: Information Schema component of MySQL Server 5.6.48 and earlier, 5.7.30 and earlier, and 8.0.20 and...

CVE-2020-15366

An issue was discovered in ajv.validate in Ajv aka Another JSON Schema Validator 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a...

CVE-2020-15366

An issue was discovered in ajv.validate in Ajv aka Another JSON Schema Validator 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a...

Code injection

An issue was discovered in ajv.validate in Ajv aka Another JSON Schema Validator 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a...

UBUNTU-CVE-2020-15366

An issue was discovered in ajv.validate in Ajv aka Another JSON Schema Validator 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a...

CVE-2020-15366

An issue was discovered in ajv.validate in Ajv aka Another JSON Schema Validator 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a...

CVE-2020-15366

An issue was discovered in ajv.validate in Ajv aka Another JSON Schema Validator 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a...

CVE-2020-15366

CVE-2020-15366 affects Ajv (Another JSON Schema Validator) 6.12.2. A crafted JSON schema can trigger a prototype pollution vulnerability in the ajv.validate() function, potentially allowing execution of arbitrary code. This is explicitly described as enabling code execution via polluted prototype...

CVE-2020-15366

An issue was discovered in ajv.validate in Ajv aka Another JSON Schema Validator 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a...

UBUNTU-CVE-2020-14559

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Information Schema. Supported versions that are affected are 5.6.48 and prior, 5.7.30 and prior and 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple...

CVE-2020-14559

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Information Schema. Supported versions that are affected are 5.6.48 and prior, 5.7.30 and prior and 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple...

CVE-2020-14559

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Information Schema. Supported versions that are affected are 5.6.48 and prior, 5.7.30 and prior and 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple...

PT-2020-14394

Name of the Vulnerable Software and Affected Versions Ajv versions 6.12.2 Description An issue was discovered in ajv.validate that allows execution of other code by prototype pollution when a carefully crafted JSON schema is provided. The worst-case scenario for an untrusted schema should be a...

CVE-2020-14559: Undefined Security Weakness

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Information Schema. Supported versions that are affected are 5.6.48 and prior, 5.7.30 and prior and 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple...

PT-2020-22508

Name of the Vulnerable Software and Affected Versions Sass affected versions not specified Description The issue is related to a heap-buffer-overflow read, which occurs in the Sass::Prelexer::quoted string function. This function is called by Sass::Parser::lex and Sass::Parser::parse value schema...

OSV-2020-22 Container-overflow in parquet::schema::Unflatten

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20897 Crash type: Container-overflow READ 4 Crash state: parquet::schema::Unflatten parquet::FileMetaData::FileMetaDataImpl::FileMetaDataImpl parquet::FileMetaData::FileMetaData...

PT-2020-22157

Name of the Vulnerable Software and Affected Versions parquet affected versions not specified Description The issue is related to a crash caused by a container-overflow read. It occurs in the parquet::schema::Unflatten function, which is part of the...

libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c

A memory leak was found in the xmlSchemaValidateStream function of libxml2. Applications that use this library may be vulnerable to memory not being freed leading to a denial of service. System availability is the highest threat from this vulnerability...

Node.js third-party modules: Fastify uses allErrors: true ajv configuration by default which is susceptible to DoS

I would like to report a denial of service vulnerability in fastify It allows to cause a DoS with some schemas that were otherwise assumed to be secure against DoS by their authors Module module name: fastify version: 2.14.1, 3.0.0-rc.4 npm page: https://www.npmjs.com/package/fastify Module...