8512 matches found
PYSEC-2021-8
In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 with Python 3.9.5+, URLValidator does not prohibit newlines and tabs unless the URLField form field is used. If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffecte...
CVE-2021-24254
The College publisher Import WordPress plugin through 0.1 does not check for the uploaded CSV file to import, allowing high privilege users to upload arbitrary files, such as PHP, leading to RCE. Due to the lack of CSRF check, the issue could also be exploited via a CSRF attack...
CVE-2021-29245
BTCPay Server through 1.0.7.0 uses a weak method Next to produce pseudo-random values to generate a legacy API key...
CVE-2021-29245
BTCPay Server through 1.0.7.0 uses a weak method Next to produce pseudo-random values to generate a legacy API key...
CVE-2021-29245
BTCPay Server through 1.0.7.0 uses a weak method Next to produce pseudo-random values to generate a legacy API key...
PT-2021-18140
Name of the Vulnerable Software and Affected Versions: BTCPay Server versions 1.0.0 through 1.0.7.0 Description: The issue is related to the generation of a legacy API key using a weak method to produce pseudo-random values. Recommendations: For BTCPay Server versions 1.0.0 through 1.0.7.0,...
The vulnerability of the LOV sub-component of the Oracle Depot Repair component in the Oracle E-Business Suite automation system allows a malicious individual to gain unauthorized access to the device and disclose protected information.
The vulnerability of the LOV sub-component of the Oracle Depot Repair component in the Oracle E-Business Suite automation system is related to code errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the device and disclose protected...
PT-2021-4109
Name of the Vulnerable Software and Affected Versions Pydantic versions prior to v1.6.2 Pydantic versions prior to v1.7.4 Pydantic versions prior to v1.8.2 Description The issue is related to the incorrect handling of 'infinity', 'inf', and float'inf' values in date fields, causing validation to...
PT-2021-6839
Name of the Vulnerable Software and Affected Versions jszip versions prior to 3.7.0 Description The issue is related to the incorrect handling of file names in the jszip library. It allows a remote attacker to cause a denial of service by crafting a new zip file with filenames set to Object...
CVE-2021-31919
An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct...
CVE-2021-31919
An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct...
Code injection
An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct...
CVE-2021-31919
An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct...
CVE-2021-31919
An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct...
CVE-2021-31919
An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct...
CVE-2021-31919
The CVE-2021-31919 entry concerns the Rust rkyv crate before version 0.6.0. During serialization, an archive may contain uninitialized values for certain struct parts, potentially affecting the serialized data’s integrity and confidentiality. The core affected component is rkyv (Rust). Publicly d...
CVE-2021-31919: Missing Initialization of Resource
An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct...
CVE-2021-25810
Cross site Scripting XSS vulnerability in MERCUSYS Mercury X18G 1.0.5 devices, via crafted values to the 'srcdportstart', 'srcdportend', and 'destport' parameters...