CVE-2021-40892

A Regular Expression Denial of Service ReDOS vulnerability was discovered in validate-color v2.1.0 when handling crafted invalid rgba strings...

deep-get-set 安全漏洞

deep-get-set is used to set and obtain values on objects via dotted strings. deep-get-set package in all versions suffers from a prototype pollution vulnerability that stems from the vulnerability of products to uncontrolled modification of object prototype properties. An attacker could exploit...

CVE-2021-40892: Inefficient Regular Expression Complexity

A Regular Expression Denial of Service ReDOS vulnerability was discovered in validate-color v2.1.0 when handling crafted invalid rgba strings...

MAL-2022-3440 Malicious code in gradient-strings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 85b41f21443655193e21b66bf003d6b42f6bad9f00cc324004094871ca932651 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-11462

Name of the Vulnerable Software and Affected Versions JerryScript version 2.4.0 Description The issue is related to a heap-use-after-free error at ecma-helpers-string.c:1940 in the ecma compare ecma non direct strings function. Recommendations For JerryScript version 2.4.0, at the moment, there i...

JerryScript 资源管理错误漏洞

JerryScript is a lightweight JavaScript engine from the Jerryscript project. version 2.4.0 of JerryScript is vulnerable to a memory misquoting vulnerability that originates in ecma-helpers- in ecmacompareecmanondirectstrings. string.c:1940, which is responsible for freeing memory, is garbled. An...

CVE-2022-31753

The voice wakeup module has a vulnerability of using externally-controlled format strings. Successful exploitation of this vulnerability may affect system availability...

Format string

The voice wakeup module has a vulnerability of using externally-controlled format strings. Successful exploitation of this vulnerability may affect system availability...

CVE-2022-31753

The voice wakeup module has a vulnerability of using externally-controlled format strings. Successful exploitation of this vulnerability may affect system availability...

CVE-2022-31753

The CVE-2022-31753 entry describes a vulnerability in the voice wakeup module where externally-controlled format strings can be exploited, potentially impacting system availability. Connected sources attribute the issue to Huawei/HarmonyOS implementations (notably HarmonyOS 2.0) and reiterate tha...

Command Injection

Nuitka is vulnerable to command injection. The vulnerability exists in the main function of main.py, allowing an attacker with the privileges of the running program by setting NUITKAPYTHONPATH, NUITKANAMESPACES or NUITKAPTHIMPORTED to inject and execute malicious payload strings...

Cisco IOS Software FXO Interface Destination Pattern Bypass (cisco-sa-fxo-pattern-bypass-jUXgygYv)

According to its self-reported version, Cisco IOS is affected by a vulnerability. A vulnerability in the Voice Telephony Service Provider VTSP service of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass configured destination patterns and dial...

USN-5315-1 ansible vulnerabilities

It was discovered that Ansible did not properly manage directory permissions when running playbooks with an unprivileged become user. A local attacker could possibly use this issue to cause a race condition, escalate privileges and execute arbitrary code. This issue only affected Ubuntu 16.04 ESM...

Moment.js: Path traversal in moment.locale

A path traversal vulnerability was found in Moment.js that impacts npm server users. This issue occurs if a user-provided locale string is directly used to switch moment locale, which an attacker can exploit to change the correct path to one of their choice. This can result in a loss of integrity...

[slackware-security] cups

New cups packages are available for Slackware 14.2, 15.0, and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/cups-2.4.2-i586-1slack15.0.txz: Upgraded. Fixed certificate strings comparison for Local authorization. For more information, se...

CVE-2022-24414: Use of GET Request Method With Sensitive Query Strings

Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests. These request parameters can get logged in reverse proxies and server logs. Attackers may potentially use these tokens to access CloudLink server. Tokens should not be used in request URL to avoid such attac...

Read buffer overruns processing ASN.1 strings

ASN.1 strings are represented internally within OpenSSL as an ASN1STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL 0 byte...

GHSA-Q9WJ-F4QW-6VFJ Read buffer overruns processing ASN.1 strings

ASN.1 strings are represented internally within OpenSSL as an ASN1STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL 0 byte...

OS Command Injection

maven-shared-utils is vulnerable to OS command injection. The vulnerability exists due to the use of double-quoted strings without proper escaping which allows an attacker to execute shell commands...

CVE-2021-32921

An issue was discovered in Prosody before 0.11.9. It does not use a constant-time algorithm for comparing certain secret strings when running under Lua 5.2 or later. This can potentially be used in a timing attack to reveal the contents of secret strings to an attacker...