rpm: unsigned signature header leads to string injection into an rpm database

A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity...

Unspecified vulnerability in Weidmueller Industrial WLAN devices

Weidmueller Industrial WLAN devices is an industrial WIAN from Weidmueller, Germany. A security vulnerability exists in Weidmueller Industrial WLAN devices, which can be exploited by an attacker to cause an escape from a restricted console via a specially crafted menu selection string, resulting ...

Weidmueller Industrial WLAN devices formatting string error vulnerability

Weidmueller Industrial WLAN devices is an industrial WIAN from Weidmueller, Germany. A Format String Error vulnerability exists in Weidmueller Industrial WLAN devices, which stems from a specially crafted time server entry that can lead to a time server buffer overflow that can be exploited by an...

Khan Academy: Client Side string length check

A client-side string length check vulnerability allowed an attacker to save excessively long strings in the "Class Settings" page on khanacademy.org, potentially causing various issues such as content manipulation, page template breaking, and crashing for low-memory visitors...

CVE-2021-33535

In Weidmueller Industrial WLAN devices in multiple versions an exploitable format string vulnerability exists in the iwconsole coniowritestr functionality. A specially crafted time server entry can cause an overflow of the time server buffer, resulting in remote code execution. An attacker can se...

CVE-2021-33535

In Weidmueller Industrial WLAN devices in multiple versions an exploitable format string vulnerability exists in the iwconsole coniowritestr functionality. A specially crafted time server entry can cause an overflow of the time server buffer, resulting in remote code execution. An attacker can se...

CVE-2021-33535

Weidmueller Industrial WLAN devices are affected by a format string vulnerability in the iw_console conio_writestr function. A specially crafted time server entry can cause a buffer overflow, enabling remote code execution. Attack requires authentication as a low-privilege user and the exploit pa...

CVE-2021-33535 WEIDMUELLER: WLAN devices affected by exploitable format string vulnerability

In Weidmueller Industrial WLAN devices in multiple versions an exploitable format string vulnerability exists in the iwconsole coniowritestr functionality. A specially crafted time server entry can cause an overflow of the time server buffer, resulting in remote code execution. An attacker can se...

The vulnerability of the library for syntactic analysis and generation of CSS Color-String strings allows a attacker to cause a service failure.

The vulnerability of the library for syntactic analysis and generation of CSS Color-String strings is related to the unlimited distribution of resources. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

Weidmueller Industrial WLAN 格式化字符串错误漏洞

Weidmueller Industrial WLAN devices is an industrial WIAN from Weidmueller, Germany. A Format String Error vulnerability exists in Weidmueller Industrial WLAN devices, which stems from a specially crafted time server entry that can lead to a time server buffer overflow that can be exploited by an...

Regular Expression Denial Of Service (ReDoS)

is-svg is vulnerable to regular expression denial of service. An attacker may input a malicious crafted SVG string, causing the system to crash...

HPE RDA-CAS 1.23.826 Denial Of Service Exploit

!/usr/bin/python -- coding: UTF-8 -- hpfreeze.py HPE Remote Device Access Unauthenticated Denial of Service Jeremy Brown jbrown3264/gmail June 2021 "Designed for the enterprise, HPE RDA Remote Device Access provides integrated remote connectivity for support automation, device telemetry and remot...

CVE-2021-29060

A Regular Expression Denial of Service ReDOS vulnerability was found in Color-String, which occurs when the application is provided and checks a crafted invalid HWB string. The highest threat from this vulnerability is to system availability...

CVE-2021-29059

A flaw was found in IS-SVG where a Regular Expression Denial of Service ReDOS occurs if the application is provided and checks a crafted invalid SVG string. The highest threat from this vulnerability is to system availability...

Cross-site Scripting (XSS)

mongo-express is vulnerable to cross-site scripting. An attacker is able to inject and execute malicious script via a string property of documents when only preview is loaded...

Regular Expression Denial Of Service (ReDoS)

color-string is vulnerable to regular expression denial of service. An attacker parsing a malicious crafted string that consist of more than 5000 characters into the hwb or hsl function will cause the system to crash...

@apollosproject/apollos-cli (>=2.43.1-canary.4, <=3.0.0), @apollosproject/react-native-make (>=3.0.4, <=3.0.5) +22 more potentially affected by CVE-2021-29060 via color-string (>=1.2.0, <=1.5.3)

color-string NPM version =1.2.0, =2.43.1-canary.4, =3.0.4, =3.0.2, =1.0.0, =2.1.2, =3.0.1, =2.4.0, =3.2.4, =0.0.0-alpha.1, =0.0.0-alpha.1, =0.0.0-alpha.1, =0.0.0-alpha.1, =0.0.3, =0.0.0-alpha.1, =0.0.7 and more Source cves: CVE-2021-29060 Source advisory: OSV:GHSA-257V-VJ4P-3W2H...

GHSA-257V-VJ4P-3W2H Regular Expression Denial of Service (ReDOS)

In the npm package color-string, there is a ReDos Regular Expression Denial of Service vulnerability regarding an exponential time complexity for linearly increasing input lengths for hwb color strings. Strings reaching more than 5000 characters would see several milliseconds of processing time;...

Regular Expression Denial of Service (ReDOS)

In the npm package color-string, there is a ReDos Regular Expression Denial of Service vulnerability regarding an exponential time complexity for linearly increasing input lengths for hwb color strings. Strings reaching more than 5000 characters would see several milliseconds of processing time;...

iPhone Wi-Fi Crushed by Weird Network

FUD is spreading about a weirdly named personal network that a reverse engineer stumbled across and which he said “permanently” wrecked his iPhone’s Wi-Fi. TL;DR version: The twitching inflicted on his iPhone, which he demonstrated in the 4-second Tweet below, wasn’t permanent. As replies to the...