Malicious code in syntax_manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8dd561aa22045ba2200283780d7e714888d3f1a5a62a20ee656d9c10f5890d92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the vector graphics editor CorelDRAW Graphics Suite (formerly CorelDRAW) relates to the execution of operations beyond the buffer boundaries in memory, allowing attackers to execute arbitrary code.

The vulnerability of the CorelDRAW Graphics Suite formerly CorelDRAW graphic editor relates to the execution of operations beyond the buffer boundaries in memory during the syntax analysis of PCX files. Exploiting this vulnerability can allow attackers to execute arbitrary code using a specially...

[SECURITY] Fedora 35 Update: ghc-cmark-gfm-0.2.5-1.fc35

This package provides Haskell bindings for , the reference parser for , a fully specified variant of Markdown. It includes sources for libcmark-gfm 0.29.0.gfm.6 and does not require prior installation of the C library...

Dart 安全漏洞

Dart is an open source programming language. A security vulnerability exists in Dart versions prior to 2.18 and prior to 3.30 that stems from the use of RFC 3986 syntax for its Dart URI class, which results in an incompatibility with the "" character in the uri, which could lead to bypassing...

GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.

...

The vulnerability of the library function for working with X.509 certificates, LibKSBA, is related to a numerical overflow in the syntax analyzer CRL. This allows an attacker to execute any code in the target system.

The vulnerability of the library’s certificate handling function for X.509 certificates is related to a numerical overflow in the CRL syntax analyzer. Exploiting this vulnerability allows an attacker to send specially crafted data to the application, trigger a numerical overflow, and execute...

The vulnerability of the virtual learning environment Moodle, related to incorrect validation of input data, allows a violator to execute arbitrary code.

The vulnerability in the virtual training environment Moodle is related to incorrect validation of input data during syntax analysis of PostScript files. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

AZL-44541 CVE-2022-37598 affecting package js-jquery 3.5.0-4

Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report...

Memory exhaustion when compiling regular expressions in regexp/syntax

...

Mageia: Security Advisory (MGASA-2022-0377)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 36 Update: gitqlient-1.5.0-2.fc36

GitQlient, pronounced as git+client /g=EF=BF=BD=EF=BF=BDt=EF=BF=BD=EF=BF=BDk la=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BDnt/ is a multi-platform Git client originally forked from QGit. Nowadays it goes beyond of just a fork and adds a lot of new functionality. Some of the major feature you can find are...

Allocation of Resources Without Limits or Throttling

Overview std/regexp/syntax is a Go standard library package std/regexp/syntax Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. Go Vulnerability Report:Programs which compile regular expressions from untrusted sources may be vulnerable to...

CATS - REST API Fuzzer And Negative Testing Tool For OpenAPI Endpoints

REST API fuzzer and negative testing tool. Run thousands of self-healing API tests within minutes with no coding effort! Comprehensive : tests are generated automatically based on a large number scenarios and cover every field and header Intelligent : tests are generated based on data types and...

GHSA-XR6M-2P4M-JVQF XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability

Impact It's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the request URL parameter using the XWikiServerClassSheet if the user has view access to this sheet and another page that has been saved with programming rights, a standard condition on a...

[SECURITY] Fedora 37 Update: curl-7.85.0-1.fc37

curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

The vulnerability of the SAP BusinessObjects BW Publisher Service software integration platform lies in the lack of commas in the syntax of elements or search paths, which allows attackers to exploit this to increase their privileges.

The vulnerability of the SAP BusinessObjects BW Publisher Service software integration platform is related to the absence of commas in the syntax of elements or search paths. Exploiting this vulnerability can allow attackers to enhance their privileges...

Friday Squid Blogging: The Language of the Jumbo Flying Squid

The jumbo flying squid Dosidicus gigas uses its color-changing ability as a language: In 2020, however, marine biologists discovered that jumbo flying squid are surprisingly coordinated. Despite their large numbers, the squid rarely bumped into each other or competed for the same prey. The...

MAL-2022-1450 Malicious code in bael-plugin-syntax-dynramic-import (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca89ab83d060f762a8d1c46b906c3441300e2971fa90c2eb35024e919b2d0c97 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-8CWQ-4CMF-PX73 PocketMine-MP invalid skin geometry JSON data leading to server crash

Impact pocketmine\entity\Skin doesn't correctly handle errors produced by adhocore/json-comment, which throws RuntimeException rather than returning false as PocketMine-MP expects. This leads to a server crash if the skin geometry data is invalid for some reason e.g. a syntax error. Patches...

NextAuth.js before 4.10.3 and 3.29.10 sending verification requests (magic link) to unwanted emails

Impact next-auth users who are using the EmailProvider either in versions before 4.10.3 or 3.29.10 are affected. If an attacker could forge a request that sent a comma-separated list of emails eg.: [email protected],[email protected] to the sign-in endpoint, NextAuth.js would send emails to...