7325 matches found
PYSEC-2021-30
OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters...
Exploit for Command Injection in Rubyonrails Rails
CVE-2019-5420.rb POC Explo...
Siemens Linux-based Products (Update J)
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please seeSiemens' ProductCERT Security Advisories CERT Services | Services |...
Unspecified Vulnerability in Rust (CNVD-2021-38316)
Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in Rust rkyv crate versions prior to 0.6.0, which stems from the fact that when an archive is created via serialization, the contents of the archive may contain uninitialized valu...
GHSA-CHWR-HF3W-C984 Regular Expression Denial of Service in dat.gui
All versions of package dat.gui are vulnerable to Regular Expression Denial of Service ReDoS via specifically crafted rgb and rgba values...
Regular Expression Denial of Service in dat.gui
All versions of package dat.gui are vulnerable to Regular Expression Denial of Service ReDoS via specifically crafted rgb and rgba values...
PT-2021-3112 · Moodle +1 · Moodle +1
Name of the Vulnerable Software and Affected Versions: Moodle versions 3.8 to 3.8.8 Moodle versions 3.9 to 3.9.6 Moodle versions 3.10 to 3.10.3 Description: The issue is related to information disclosure. Exploitation of this issue could allow a remote attacker to gain unauthorized access to...
PYSEC-2021-8
In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 with Python 3.9.5+, URLValidator does not prohibit newlines and tabs unless the URLField form field is used. If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffecte...
CVE-2021-24254
The College publisher Import WordPress plugin through 0.1 does not check for the uploaded CSV file to import, allowing high privilege users to upload arbitrary files, such as PHP, leading to RCE. Due to the lack of CSRF check, the issue could also be exploited via a CSRF attack...
CVE-2021-29245
BTCPay Server through 1.0.7.0 uses a weak method Next to produce pseudo-random values to generate a legacy API key...
The vulnerability of the LOV sub-component of the Oracle Depot Repair component in the Oracle E-Business Suite automation system allows a malicious individual to gain unauthorized access to the device and disclose protected information.
The vulnerability of the LOV sub-component of the Oracle Depot Repair component in the Oracle E-Business Suite automation system is related to code errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the device and disclose protected...
PT-2021-4109
Name of the Vulnerable Software and Affected Versions Pydantic versions prior to v1.6.2 Pydantic versions prior to v1.7.4 Pydantic versions prior to v1.8.2 Description The issue is related to the incorrect handling of 'infinity', 'inf', and float'inf' values in date fields, causing validation to...
CVE-2021-31919
An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct...
CVE-2021-31919
An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct...
Code injection
An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct...
CVE-2021-31919
An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct...
CVE-2021-31919
The CVE-2021-31919 entry concerns the Rust rkyv crate before version 0.6.0. During serialization, an archive may contain uninitialized values for certain struct parts, potentially affecting the serialized data’s integrity and confidentiality. The core affected component is rkyv (Rust). Publicly d...
CVE-2021-25810
Cross site Scripting XSS vulnerability in MERCUSYS Mercury X18G 1.0.5 devices, via crafted values to the 'srcdportstart', 'srcdportend', and 'destport' parameters...