OESA-2022-1720 tcl security update

TclTool Command Language provides a powerful platform for creating integration applications that tie together diverse applications, protocols, devices, and frameworks. When paired with the Tk toolkit, Tcl provides the fastest and most powerful way to create GUI applications that run on linux, Uni...

validate-color 安全漏洞

validate-color is a Norwegian Wallace Sidhrée personal developer for validating HTML colors. A denial of service vulnerability exists in validate-color version v2.1.0, which can be exploited to cause a Regular Expression Denial of Service ReDOS by an attacker who fails to properly handle a crafte...

CVE-2022-34194

Jenkins Readonly Parameter Plugin 1.0.0 and earlier does not escape the name and description of Readonly String and Readonly Text parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

Huawei EulerOS: Security Advisory for libinput (EulerOS-SA-2022-1935)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the “Main” function in TOTOLINK A3000RU router microprogramming software allows a intruder to execute arbitrary commands.

The vulnerability of the “Main” function in TOTOLINK A3000RU router microprogramming systems is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands through the QUERYSTRING parameter...

USN-5348-3 smarty3 vulnerabilities

USN-5348-1 fixed several vulnerabilities in Smarty. This update provides the fixes for CVE-2021-21408, CVE-2021-26119, CVE-2021-26120 and CVE-2021-29454 for Ubuntu 20.04 ESM. Original advisory details: David Gnedt and Thomas Konrad discovered that Smarty was incorrectly sanitizing the paths prese...

CVE-2022-31307

Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njsstringoffset at src/njsstring.c...

Denial Of Service (DoS)

fast-string-search is vulnerable to denial of service. The vulnerability exists due to incorrect computations for non-string inputs which allows an attacker to gain read access from non-permitted locations and cause an application crash...

Nginx 资源管理错误漏洞

Nginx is a lightweight web server/reverse proxy server and email IMAP/POP3 proxy server from Nginx Inc. in the United States. njs is one of the scripting language components that supports extended NGINX functionality. A security vulnerability exists in Nginx NJS version v0.7.2, which stems from a...

fast-string-search denial-of-service vulnerability

fast-string-search is a search function that can search for strings using N-API and boyer-moore-magiclen. fast-string-search suffers from a denial-of-service vulnerability that stems from incorrect computation of non-string input, which can be exploited by an attacker to cause fast-string- search...

Malicious code in non-string-num (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c430d1d68111014594a9adefc76a74cc7f5cb9052db663c69fd1df535d8bd61 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3439 Malicious code in gradient-stringnnnn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbc90d7f1ec5dc1c1558900467a2043b34a1473f060fa9855e8963f898c382d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gradient-stringn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 113c8aa7e58460260ad95b3d81fb9e9e4630315cd65aca4be2e12ba86400a49e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1639 Malicious code in body-string-rest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d5906e08fd5b0e690abbc491c404720f69bfaa3ba84fae8bf7938522c6ac64f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2021-41682

There is a heap-use-after-free at ecma-helpers-string.c:1940 in ecmacompareecmanondirectstrings in JerryScript 2.4.0...

UBUNTU-CVE-2021-41682

There is a heap-use-after-free at ecma-helpers-string.c:1940 in ecmacompareecmanondirectstrings in JerryScript 2.4.0...

Heap overflow

There is a heap-use-after-free at ecma-helpers-string.c:1940 in ecmacompareecmanondirectstrings in JerryScript 2.4.0...

CVE-2021-41682

CVE-2021-41682 reports a heap-use-after-free in JerryScript 2.4.0, caused by a flaw in ecma_compare_ecma_non_direct_strings at ecma-helpers-string.c:1940. The vulnerability affects the string handling path and has been described across multiple sources as potentially enabling crashes and, in some...

JerryScript 资源管理错误漏洞

JerryScript is a lightweight JavaScript engine from the Jerryscript project. version 2.4.0 of JerryScript is vulnerable to a memory misquoting vulnerability that originates in ecma-helpers- in ecmacompareecmanondirectstrings. string.c:1940, which is responsible for freeing memory, is garbled. An...

GHSA-4263-Q746-94MW Uncontrolled Resource Consumption in fast-string-search

All versions of package fast-string-search are vulnerable to Denial of Service DoS when computations are incorrect for non-string inputs. One can cause the V8 to attempt reading from non-permitted locations and cause a segmentation fault due to the violation...