org.ocpsoft.rewrite.showcase:rewrite-showcase-transform (2.0.0.beta1), org.ocpsoft.rewrite:rewrite-distribution (2.0.0.beta1) +1 more potentially affected by CVE-2018-1000075 via org.jruby:jruby-stdlib (1.6.8)

org.jruby:jruby-stdlib MAVEN version 1.6.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - org.ocpsoft.rewrite.showcase:rewrite-showcase-transform 2.0.0.beta1 - org.ocpsoft.rewrite:rewrite-distribution...

org.ocpsoft.rewrite:rewrite-distribution (>=2.0.0.alpha2, <=2.0.0.alpha6), org.ocpsoft.rewrite:rewrite-transform-markup (>=1.1.0.final, <=2.0.0.alpha6) potentially affected by CVE-2018-1000075 via org.jruby:jruby-stdlib (1.6.7.2)

org.jruby:jruby-stdlib MAVEN version 1.6.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - org.ocpsoft.rewrite:rewrite-distribution =2.0.0.alpha2, =1.1.0.final, =2.0.0.alpha6 Source cves: CVE-2018-1000075...

org.ocpsoft.rewrite:rewrite-distribution (>=2.0.0.alpha2, <=2.0.0.alpha6), org.ocpsoft.rewrite:rewrite-transform-markup (>=1.1.0.final, <=2.0.0.alpha6) potentially affected by CVE-2018-1000073 via org.jruby:jruby-stdlib (1.6.7.2)

org.jruby:jruby-stdlib MAVEN version 1.6.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - org.ocpsoft.rewrite:rewrite-distribution =2.0.0.alpha2, =1.1.0.final, =2.0.0.alpha6 Source cves: CVE-2018-1000073...

org.ocpsoft.rewrite.showcase:rewrite-showcase-transform (2.0.0.beta1), org.ocpsoft.rewrite:rewrite-distribution (2.0.0.beta1) +1 more potentially affected by CVE-2018-1000073 via org.jruby:jruby-stdlib (1.6.8)

org.jruby:jruby-stdlib MAVEN version 1.6.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - org.ocpsoft.rewrite.showcase:rewrite-showcase-transform 2.0.0.beta1 - org.ocpsoft.rewrite:rewrite-distribution...

GitHub Security Lab: [CPP]: Add query for CWE-190: Integer Overflow or Wraparound when using transform after operation

This bug was reported directly to GitHub Security Lab...

grok:grk_decompress_fuzzer: Heap-buffer-overflow in grk::N_AVX2::DecompressRev::transform

Project: https://github.com/GrokImageCompression/grok.git https://github.com/GrokImageCompression/grok-test-data.git Detailed Report: https://oss-fuzz.com/testcase?key=6298761858514944 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzerasangrok Platform Id...

grok:grk_decompress_fuzzer: Use-of-uninitialized-value in CachedXFORM

Project: https://github.com/GrokImageCompression/grok.git https://github.com/GrokImageCompression/grok-test-data.git Detailed Report: https://oss-fuzz.com/testcase?key=6219688004157440 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzermsangrok Platform Id...

xml-security: XPath Transform abuse allows for information disclosure

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any...

CVE-2022-25244

Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuration endpoint to authorized operators with read permissions on this endpoint. Fixed in Vault Enterprise 1.9.4, 1.8.9 and 1.7.10...

CVE-2022-25244

Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuration endpoint to authorized operators with read permissions on this endpoint. Fixed in Vault Enterprise 1.9.4, 1.8.9 and 1.7.10...

Code injection

Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuration endpoint to authorized operators with read permissions on this endpoint. Fixed in Vault Enterprise 1.9.4, 1.8.9 and 1.7.10...

CVE-2022-25244

Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuration endpoint to authorized operators with read permissions on this endpoint. Fixed in Vault Enterprise 1.9.4, 1.8.9 and 1.7.10...

CVE-2022-25244

Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuration endpoint to authorized operators with "read" permissions on this endpoint. Fixed in Vault Enterprise 1.9.4, 1.8.9 and 1.7.10...

CVE-2022-25244: Undefined Security Weakness

Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuration endpoint to authorized operators with read permissions on this endpoint. Fixed in Vault Enterprise 1.9.4, 1.8.9 and 1.7.10...

PT-2022-17175 · Hashicorp · Vault Enterprise

Name of the Vulnerable Software and Affected Versions: Vault Enterprise versions prior to 1.7.10 Vault Enterprise versions prior to 1.8.9 Vault Enterprise versions prior to 1.9.4 Description: The issue affects Vault Enterprise clusters that use the tokenization transform feature, potentially...

USN-5314-1 firefox vulnerabilities

A use-after-free was discovered when removing an XSLT parameter in some circumstances. If a user were tricked into opening a specially crafted website, an attacker could exploit this to cause a denial of service, or execute arbitrary code. CVE-2022-26485 A use-after-free was discovered in the...

CVE-2021-44335

David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occurs in function okpngtransformscanline in "/okpng.c:533"...

CVE-2021-44335

David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occurs in function okpngtransformscanline in "/okpng.c:533"...

PT-2022-12044

Name of the Vulnerable Software and Affected Versions ok-file-formats version 203defd Description The issue occurs when using the function of the ok-file-formats project, resulting in a heap-buffer-overflow in the ok png transform scanline function located in "/ok png.c:533". Recommendations For...

ok-file-formats buffer error vulnerability

ok-file-formats is an open source decoder for PNG, JPEG, WAV and several other file formats. ok-file-formats suffers from a buffer overflow vulnerability, which stems from a heap buffer overflow that occurs when using functions of the ok-file-formats project in /okpng.c:533 in the function okpng...