13092 matches found
CVE-2021-43303
Buffer overflow in PJSUA API when calling pjsuacalldump. An attacker-controlled 'buffer' argument may cause a buffer overflow, since supplying an output buffer smaller than 128 characters may overflow the output buffer, regardless of the 'maxlen' argument supplied...
Improper Input Validation and Excessive Iteration in Go Facebook Thrift
Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift...
Hub Package Arbitrary File Overwrite
The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary patch file...
DLA-2923-1 h2database - security update
Bulletin has no description...
Vulnerability in Istio
Istio 1.1.x through 1.1.6 has Incorrect Access Control...
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type...
DLA-2924-1 libxstream-java - security update
Bulletin has no description...
GHSA-HV53-VF5M-8Q94 personnummer/go vulnerable to Improper Input Validation
This vulnerability was reported to the personnummer team in June 2020. The slow response was due to locked ownership of some of the affected packages, which caused delays to update packages prior to disclosure. The vulnerability is determined to be low severity. Impact This vulnerability impacts...
OS Command Injection in git-add-remote
git-add-remote through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the name argument...
OS Command Injection in node-key-sender
node-key-sender through 1.0.11 is vulnerable to Command Injection. It allows execution of arbitrary commands via the 'arrParams' argument in the 'execute' function...
GHSA-H6XQ-3H62-99QX Cross-site scripting in Apache Atlas
Apache Atlas before 2.1.0 contain a XSS vulnerability. While saving search or rendering elements values are not sanitized correctly and because of that it triggers the XSS vulnerability...
DLA-2917-1 openjdk-8 - security update
Bulletin has no description...
CVE-2021-39943
An authorization logic error in the External Status Check API in GitLab EE affecting all versions starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allowed a user to update the status of the check via an API call...
GHSA-WQ3V-3GRQ-6F86 Improper Control of Dynamically-Managed Code Resources in Crafter CMS Crafter Studio
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy scripting. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3.1 versions prior to 3.1.7...
CVE-2021-0177
CVE-2021-0177 describes an input validation/consistency issue in Intel® PROSet/Wireless Wi‑Fi and Killer™ Wi‑Fi software for Windows 10/11 that could allow an unauthenticated adjacent user to cause a denial of service. Connected sources provide concrete details: affected products include Intel® P...
CVE-2022-21996
Win32k Elevation of Privilege Vulnerability...
Buffer Overflow
librecad is vulnerable to buffer overflow. CDataMoji of the jwwlib component allows an attacker to achieve Remote Code Execution using a crafted JWW document...
Prototype Pollution
object-path-set is vulnerable to prototype pollution. An attacker can inject properties into existing construct prototypes via the isValidKey function of index.js and modify attributes such as proto, constructor, and prototype...