Mutt mutt_decode_uuencoded() Memory Disclosure

mutt: muttdecodeuuencoded can read the past the of the input line In muttdecodeuuencoded, the line length is read from the untrusted uuencoded part without validation. This could result in including private memory in replys, for example fragments of other messages, passphrases or keys. Reproduce...

Vim 缓冲区错误漏洞

Vim is a cross-platform text editor. buffer overflow vulnerability exists in versions of Vim prior to 9.0.0045, which stems from a boundary error in the inscompladd function when handling untrusted input. A remote attacker could exploit this vulnerability to execute arbitrary code on the system...

Huawei EulerOS: Security Advisory for python3 (EulerOS-SA-2022-1978)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GHSA-H975-R69H-4W9P Insufficient user input in Apache Jetspeed-2

UNSUPPORTED WHEN ASSIGNED Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant projec...

HUAWEI HarmonyOS Fingerprint Module Buffer Overflow Vulnerability

HUAWEI HarmonyOS is an operating system from Huawei, China HUAWEI. It provides a microkernel-based, full-scenario distributed operating system. HUAWEI HarmonyOS is vulnerable to a buffer overflow vulnerability. The vulnerability stems from a boundary error when handling untrusted input. An attack...

Mozilla Thunderbird Security Advisory (MFSA2022-19) - Windows

Mozilla Thunderbird is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...

Mozilla Thunderbird Security Advisory (MFSA2022-19) - Mac OS X

Mozilla Thunderbird is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...

Vim Buffer Overflow Vulnerability (CNVD-2022-68101)

Vim is a cross-platform text editor. buffer overflow vulnerability exists in versions of Vim prior to 9.0.0035, which stems from a boundary error in the spelldumpcompl function when handling untrusted input. A remote attacker could exploit this vulnerability to execute arbitrary code on the syste...

GHSA-F2GR-7299-487H DOS and excessive memory usage when passing untrusted user input to to dag import

Impact go-ipfs nodes crash when trying to import certain malformed CAR files due to an issue in the go-car dependency. This impacts nodes running ipfs dag import on untrusted user inputs, for example, pinning services with a car ingest endpoint. This include the corresponding HTTP RPC API...

GHSA-9X4H-8WGM-8XFG Malformed CAR panics and excessive memory usage

Impact Versions impacted = [email protected] = [email protected] Description of user-facing changes...

CVE-2022-32533

Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no...

Apache Jetspeed-2 安全漏洞

Apache Jetspeed-2 is a very open and customizable portal platform from the Apache USA Foundation. Apache Jetspeed-2 suffers from an input validation error vulnerability that stems from Apache Jetspeed-2 failing to adequately filter untrusted user input by default, which can be exploited by an...

Insufficiently complex hash function used in `useFetch` means return data cannot be trusted

Description The useFetch function uses the ohash library to key requests. This hash function outputs a 32 bit number. Finding a collision for this function is easy. In a situation where useFetch is called more than once, any call after the first that contains untrusted input into any argument is...

UBUNTU-CVE-2022-2309

NULL Pointer Dereference allows attackers to cause a denial of service or application crash. This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code...

PYSEC-2022-230

NULL Pointer Dereference allows attackers to cause a denial of service or application crash. This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code...

CVE-2022-2309

NULL Pointer Dereference allows attackers to cause a denial of service or application crash. This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code...

PYSEC-2022-230

NULL Pointer Dereference allows attackers to cause a denial of service or application crash. This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code...

CVE-2022-2309

NULL Pointer Dereference allows attackers to cause a denial of service or application crash. This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code...

PT-2022-7707 · Lxml +10 · Lxml +10

Name of the Vulnerable Software and Affected Versions: lxml versions 2.9.10 through 2.9.14 Description: The issue allows attackers to cause a denial of service or application crash when lxml is used together with libxml2. It is triggered by forged input data and a vulnerable code sequence in the...

HUAWEI HarmonyOS 安全漏洞

HUAWEI HarmonyOS is an operating system from Huawei, China HUAWEI. It provides a microkernel-based, full-scenario distributed operating system. HUAWEI HarmonyOS is vulnerable to a buffer overflow vulnerability. The vulnerability stems from a boundary error when handling untrusted input. An attack...