libxml2: Use after free via namespace node in XPointer ranges

A use-after-free flaw was found in the Xpointer implementation of libxml2. An attacker could use this flaw against an application parsing untrusted XML files and compiled with libxml2 to leak small amount of memory data...

CVE-2021-41720

Removed by vendor...

XML External Entity (XXE) Injection

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to XML External Entity XXE Injection. Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected: - Nokogiri::XML::SAX::Parse -...

GHSA-5VCM-3XC3-W7X3 Response Splitting from unsanitized headers

Impact http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names Header.nameå Header values Header.value Status reason phrases Status.reason URI paths Uri.Path URI authority registered names...

GHSA-XPFP-F569-Q3P2 SQL Injection in Django

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application...

CVE-2021-41084

http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names Header.nameå, Header values Header.value, Status reason phrases...

OESA-2021-1335 jsoup security update

jsoup is a Java library for working with real-world HTML. It provides a very convenient API for extracting and manipulating data, using the best of DOM, CSS, and jquery-like methods. Security Fixes: jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse...

Prototype Pollution in mootools

This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge...

GHSA-X6HX-7GH3-3Q98 Prototype Pollution in mootools

This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge...

GHSA-8C3F-X5F9-6H62 Command injection in @diez/generation

The @diez/generation npm package is a client for Diez. The locateFont method of @diez/generation has a command injection vulnerability. Clients of the @diez/generation library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. This issue may lead...

PT-2021-10121 · Craigms · Craigms

Name of the Vulnerable Software and Affected Versions: CraigMS version 1.0 Description: An issue in craigms/main.php allows attackers to execute arbitrary commands via a crafted input entered into the DB Name field. Recommendations: For CraigMS version 1.0, consider restricting access to the...

CVE-2021-23406

A flaw was found in nodejs-pac-resolver. A remote code execution can occur with untrusted input, due to unsafe PAC file handling. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

SUSE SLES12 Security Update : python-PyYAML (SUSE-SU-2021:2818-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2818-1 advisory. - Update to 5.3.1. - CVE-2020-14343: A vulnerability was discovered in the PyYAML library, where it was susceptible to arbitrary code...

CVE-2021-23432

This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge...

Design/Logic Flaw

This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge...

CVE-2021-23432

This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge...

UBUNTU-CVE-2021-23432

This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge...

CVE-2021-23432 Prototype Pollution

This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge...

CVE-2021-23432

CVE-2021-23432 affects all versions of the mootools library. The root cause is the ability to pass untrusted input to Object.merge() , leading to prototype pollution . Several connected sources confirm the issue and the affected component, with CVSS values indicating high to critical impact (netw...

CVE-2021-23432

This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge...