12119 matches found
DEBIAN-CVE-2020-26890
Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attackers to execute a denial of service attack against the federation and common Matrix clients. If such a malformed event is accepted into th...
Mail.ru: XSS account.mail.ru
XSS in account.mail.ru via cookie value...
Consul by HashiCorp: from Infoleak to RCE
Consul is a software first released in 2014 for DNS-based service discovery. It provides distributed key-value storage, segmentation, and configuration. Registered services and nodes can be queried using a DNS interface or an HTTP interface. Wikipedia Basically, Consul ensures the coherence of...
CVE-2020-28949
ArchiveTar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack such as file:// to overwrite files can still succeed. Recent assessments: gwillcox-r7 at January 15, 2021 8:42pm UTC reported: Original advisory and PoC can be found at...
Schneider Electric Modicon M221 Security Breach
The Schneider Electric Modicon M221 is a programmable logic controller from Schneider Electric, France. The Modicon M221 has a security vulnerability that stems from the presence of a small-space random-value vulnerability, which can be exploited by an attacker to defeat an encryption key when...
OSV-2020-2165 Use-of-uninitialized-value in isSameGfxColor
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27523 Crash type: Use-of-uninitialized-value Crash state: isSameGfxColor Gfx::doAxialShFill Gfx::opShFill...
Valeriangalliat Markdown It Highlightjs Cross-Site Scripting Vulnerability
Valeriangalliat Markdown It Highlightjs is Valeriangalliat individual developers of a Js code base for Web page Markdown highlighting . A cross-site scripting vulnerability exists in markdown-it-highlightjs versions prior to 3.3.1, which stems from the ability to insert malicious JavaScript as th...
CVE-2020-27483
Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter trusts the offset provided...
CVE-2020-27483
Garmin Forerunner 235 before 8.20 is affected by an Array index error in the ConnectIQ TVM. The attacker must upload a malicious ConnectIQ application to the ConnectIQ store; the interpreter trusts an offset for the stack value duplication instruction (DUP) that is unchecked, allowing memory befo...
Cross-site Scripting (XSS)
Overview markdown-it-highlightjs is a Preset to use highlight.js with markdown-it. Affected versions of this package are vulnerable to Cross-site Scripting XSS. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const...
Cross-site Scripting (XSS)
shopware/shopware is vulnerable to cross-site scripting XSS. The vulnerability exists as the unsanitized value of the newsletter title, headline, is displayed in the description of campaignKey...
poppler:pdf_fuzzer: Use-of-uninitialized-value in isSameGfxColor
Project: https://anongit.freedesktop.org/git/poppler/poppler.git https://gitlab.freedesktop.org/poppler/poppler.git https://gitlab.freedesktop.org/ceyhunalp/poppler.git Detailed Report: https://oss-fuzz.com/testcase?key=5661190197608448 Project: poppler Fuzzing Engine: libFuzzer Fuzz Target:...
Data race and memory safety issue in `Index`
The appendix crate implements a key-value mapping data structure called Index that is stored on disk. The crate allows for any type to inhabit the generic K and V type parameters and implements Send and Sync for them unconditionally. Using a type that is not marked as Send or Sync with Index can...
RUSTSEC-2020-0149 Data race and memory safety issue in `Index`
The appendix crate implements a key-value mapping data structure called Index that is stored on disk. The crate allows for any type to inhabit the generic K and V type parameters and implements Send and Sync for them unconditionally. Using a type that is not marked as Send or Sync with Index can...
CVE-2020-6155
A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 while parsing compressed value rep arrays in binary USD files. A specially crafted malformed file can trigger a heap overflow, which can result in remote code execution. To trigger this vulnerability, the victim needs to access an...
CVE-2020-6155
A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 while parsing compressed value rep arrays in binary USD files. A specially crafted malformed file can trigger a heap overflow, which can result in remote code execution. To trigger this vulnerability, the victim needs to access an...
CVE-2020-6155
A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 while parsing compressed value rep arrays in binary USD files. A specially crafted malformed file can trigger a heap overflow, which can result in remote code execution. To trigger this vulnerability, the victim needs to access an...
OSV-2020-2151 Use-of-uninitialized-value in tinfl_decompress
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27413 Crash type: Use-of-uninitialized-value Crash state: tinfldecompress mzinflate mzuncompress2...
Pixar OpenUSD Binary File Format Compressed Value Reps Code Execution Vulnerabilities
Summary A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 while parsing compressed value rep arrays in binary USD files. A specially crafted malformed file can trigger a heap overflow, which can result in remote code execution. To trigger this vulnerability, the victim needs to acce...