CVE-2020-23369

CVE-2020-23369 affects YzmCMS 5.6, where a cross-site scripting vulnerability exists in member/member_content/init.html due to using UEditor 1.4.3.3 . The underlying issue is an XSS via the SRC attribute of an IFRAME element, allowing injected scripts. Public records in NVD/CNVD/CNNVD confirm the...

CVE-2020-23369

In YzmCMS 5.6, XSS was discovered in member/membercontent/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3...

CVE-2020-23369: Improper Neutralization of Input During Web Page Generation

In YzmCMS 5.6, XSS was discovered in member/membercontent/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3...

GHSA-G4HJ-R7R3-9RWV OS Command Injection in gulp-scss-lint

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

CVE-2021-28855: NULL Pointer Dereference

In Deark before 1.5.8, a specially crafted input file can cause a NULL pointer dereference in the dbufwrite function src/deark-dbuf.c...

CVE-2021-28856: Divide By Zero

In Deark before v1.5.8, a specially crafted input file can cause a division by zero in src/fmtutil.c because of the value of pixelsize...

CVE-2021-20235: Buffer Copy without Checking Size of Input

There's a flaw in the zeromq server in versions before 4.3.3 in src/decoderallocators.hpp. The decoder static allocator could have its sized changed, but the buffer would remain the same as it is a static buffer. A remote, unauthenticated attacker who sends a crafted request to the zeromq server...

CVE-2021-20234: Uncontrolled Resource Consumption

An uncontrolled resource consumption memory leak flaw was found in the ZeroMQ client in versions before 4.3.3 in src/pipe.cpp. This issue causes a client that connects to multiple malicious or compromised servers to crash. The highest threat from this vulnerability is to system availability...

CVE-2021-20193: Missing Release of Memory after Effective Lifetime

A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability...

CVE-2021-20227: Use After Free

A flaw was found in SQLite's SELECT query functionality src/select.c. This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerabilit...

CVE-2021-23345: Server-Side Request Forgery (SSRF)

All versions of package github.com/thecodingmachine/gotenberg are vulnerable to Server-side Request Forgery SSRF via the /convert/html endpoint when the src attribute of an HTML element refers to an internal system file, such as...

CVE-2021-26541

The gitlog function in src/index.ts in gitlog before 4.0.4 has a command injection vulnerability...

CVE-2021-26541

The gitlog function in src/index.ts in gitlog before 4.0.4 has a command injection vulnerability...

Command injection

The gitlog function in src/index.ts in gitlog before 4.0.4 has a command injection vulnerability...

EUVD-2021-0771

The gitlog function in src/index.ts in gitlog before 4.0.4 has a command injection vulnerability...

CVE-2021-26540

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts...

CVE-2021-26541: Improper Neutralization of Special Elements used in an OS Command

The gitlog function in src/index.ts in gitlog before 4.0.4 has a command injection vulnerability...

Ron-checkmarx gitlog command injection vulnerability

Ron-checkmarx gitlog is a parser from the US-based Ron-checkmarx organization. It provides a Git log parser for Node.JS. A command injection vulnerability exists in gitlog version 4.0.4, which stems from the gitlog function in src/index not properly filtering special elements within it. An attack...

GHSA-VV2X-VRPJ-QQPQ Cross-site scripting in Bleach

Impact A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument stripcomments=False Note: none of the above tags are in the default...

CVE-2021-23326: Improper Neutralization of Special Elements used in an OS Command

This affects the package @graphql-tools/git-loader before 6.2.6. The use of exec and execSync in packages/loaders/git/src/load-git.ts allows arbitrary command injection...