2586 matches found
CVE-2020-7750
This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the transformMeasurements function...
Cross-site Scripting (XSS)
Overview scratch-svg-renderer is a SVG renderer for Scratch Affected versions of this package are vulnerable to Cross-site Scripting XSS. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the transformMeasurements function. Detai...
golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash
A denial of service vulnerability was found in the golang.org/x/text library. A library or application must use one of the vulnerable functions, such as unicode.Transform, transform.String, or transform.Byte, to be susceptible to this vulnerability. If an attacker is able to supply specific...
Moderate: Red Hat Security Advisory: libsrtp security and bug fix update
An update for libsrtp is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash
A denial of service vulnerability was found in the golang.org/x/text library. A library or application must use one of the vulnerable functions, such as unicode.Transform, transform.String, or transform.Byte, to be susceptible to this vulnerability. If an attacker is able to supply specific...
PT-2020-21029
Name of the Vulnerable Software and Affected Versions css transform step version 1.0.6 Description The issue concerns malicious code in version 1.0.6 of the css transform step module. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber from form...
PT-2020-21002
Name of the Vulnerable Software and Affected Versions css transform support version 1.0.2 Description The issue concerns malicious code in version 1.0.2 of the css transform support module. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber fro...
OpenJDK: Incomplete bounds checks in Affine Transformations (2D, 8240119)
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: 2D. Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple...
PT-2020-22245
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash caused by a use-of-uninitialized-value error. The crash occurs in the following functions: inv txfm2d add facade, av1 inv...
CVE-2020-14040
The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to...
Loop with Unreachable Exit Condition (Infinite Loop)
The x/text package for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an...
CVE-2020-12889
MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case...
Design/Logic Flaw
MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case...
PYSEC-2020-66
MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case...
PYSEC-2020-66
MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case...
CVE-2020-12889
MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case...
CVE-2020-12889
The CVE-2020-12889 entry concerns MISP-maltego 1.4.4, where the MISP connection is incorrectly shared across users during a remote-transform use case. The issue implies a faulty isolation mechanism between user sessions, allowing cross-user access to the MISP connection. Remediation is noted as a...
CVE-2020-12889
MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case...
PT-2020-13320
Name of the Vulnerable Software and Affected Versions MISP MISP-maltego version 1.4.4 Description The issue arises from MISP MISP-maltego incorrectly sharing a MISP connection across users in a remote-transform use case. No information is provided about the estimated number of potentially affecte...
