CVE-2022-23620: Improper Limitation of a Pathname to a Restricted Directory

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionHandlerprocessSx does not escape anything from SSX document references when serializing it on filesystem, it is possible to for the HTML...

Open Policy Agent security vulnerabilities

Open Policy Agent is an open source general-purpose policy engine that enables uniform, context-aware policy enforcement across the stack. Open Policy Agent suffers from a security vulnerability that stems from the fact that under certain conditions, pretty-printing an Abstract Syntax Tree AST...

AlmaLinux 8 : raptor2 (ALSA-2021:1842)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:1842 advisory. - raptorxmlwriterstartelementcommon in raptorxmlwriter.c in Raptor RDF Syntax Library 2.0.15 miscalculates the maximum nspace declarations for the XML...

Cross-site Scripting (XSS) - Stored in vanessa219/vditor

Description The Vanessa219/vditor is a markdown editor supported by browsers. When a user creates a link using the markdown syntax, the server does not URL-encode the double-quotes, so the user can escape the href attribute and trigger XSS using the on attribute. Proof of Concept txt XSS PoC : xs...

Highlight.js Data Compromise

The vulnerability of the Highlight.js lighting syntax tool is related to modifications of assumed data. Exploiting this vulnerability can allow an attacker to compromise data integrity and also cause service failures...

CVE-2021-46142

An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax...

UriParser resource management error vulnerability

Uriparser is a Uri parsing and processing library written in C89 that strictly conforms to Rfc 3986. uriparser is vulnerable to a resource management error that stems from uriparser prior to 0.9.6 performing invalid free operations in uriNormalizeSyntax. No detailed vulnerability details are...

UriParser resource management error vulnerability

Uriparser is a strictly Rfc 3986 compliant Uri parsing and processing library written in C89. A security vulnerability exists in uriparser that stems from uriparser prior to 0.9.6 performing an invalid free action in uriNormalizeSyntax...

Mozilla Thunderbird buffer error vulnerability

Mozilla Thunderbird is the United States Mozilla Foundation's set of independent from the Mozilla Application Suite e-mail client software. The software supports IMAP, POP mail protocols, and HTML mail formats. Mozilla Thunderbird suffers from a buffer error vulnerability that originates from a...

OpenLDAP DoS

The vulnerability of the open implementation of the OpenLDAP protocol lies in the difficulty of verifying syntax analysis. Exploiting this vulnerability allows a malicious actor to perform a denial-of-service attack by sending a specially crafted request to slapd...

Adobe Premiere Pro Buffer Overflow

The vulnerability of the professional video editing software Adobe Premiere Pro lies in the fact that operations may go beyond the buffer limits in memory during the syntax analysis of 3GP files. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created...

Adobe Premiere Rush Unauthorized Access

The vulnerability of Adobe Premiere Rush is related to insufficient validation of input data during the MP4 file syntax analysis. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

ROS-20211223-03

Vulnerability in an open source implementation of the OpenLDAP protocol is related to a reachability assertion. Exploitation exploitation of the vulnerability could allow an attacker acting remotely to send a specially crafted packet with a short timestamp to slapd and perform a denial of service...

Exploit for Path Traversal in Apache Http_Server

Vulnerability Name Apache Remote Code Execution CVE-2021-42...

JT Utilities JT Open Toolkit Buffer Overflow RCE

The vulnerability of the JT Utilities and JT Open Toolkit JTTK application development tools is related to data writing outside of the buffer during JT file syntax analysis. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

JT Utilities Buffer Overflow

The vulnerability of the JT Utilities and JT Open Toolkit JTTK application development tools is related to buffer overflows in the stack during syntax analysis of JT files. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS S/MIME PKCS \#7 or PKCS \#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS X.509 OCSP or CRL functionality may be impacted depending on how they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However email clients and PDF viewers that use NSS for signature verification such as Thunderbird LibreOffice Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.

...

CLSA-2021-1639681783 Fix CVE(s): CVE-2021-3712

SECURITY UPDATE: fix assumption that ASN.1 string is NULL terminated when it exactly doesn't. - debian/patches/CVE-2021-3712.patch: backport all found cases where code relayed on assumtion that ASN.1 string is NULL terminated - CVE-2021-3712...

FATEK WinProladder Buffer Overflow

The vulnerability of the FATEK WinProladder controller programming software lies in the fact that the write operation goes beyond the buffer boundaries into memory during the syntax analysis of project files. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a...

nuclei-templates

This is a GitHub repository for a community-driven project called "Nuclei Templates". The project provides a collection of templates for the Nuclei engine to find security vulnerabilities in applications. The repository contains various files and workflows for managing and updating the templates,...