PT-2021-10167 · Cesanta · Cesanta Mjs

Name of the Vulnerable Software and Affected Versions: Cesanta MJS version 1.20.1 Description: The issue is a stack overflow vulnerability in the parse array function, which allows remote attackers to cause a Denial of Service DoS via a crafted file. Recommendations: For Cesanta MJS version 1.20....

CVE-2021-33183

Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability container volume management component in Synology Docker before 18.09.0-0515 allows local users to read or write arbitrary files via unspecified vectors...

pycnet-audio (>=0.5.1 <=0.5.8) potentially affected by CVE-2021-29612 via tensorflow-cpu (=2.2.0)

tensorflow-cpu PYPI version =2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - pycnet-audio =0.5.1, =0.5.8 Source cves: CVE-2021-29612 Source advisory: OSV:GHSA-2XGJ-XHGF-GGJV...

c4v-py (>=0.1.0.dev1 <=0.1.0.dev202107081840) potentially affected by CVE-2021-29575 via tensorflow-cpu (=2.3.1)

tensorflow-cpu PYPI version =2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - c4v-py =0.1.0.dev1, =0.1.0.dev202107081840 Source cves: CVE-2021-29575 Source advisory: OSV:GHSA-6QGM-FV6V-RFPV...

d3m-simon (=1.2.5), easyquake (>=1.3.0 <=1.4.0) potentially affected by CVE-2021-29538 via tensorflow-gpu (=2.2.0)

tensorflow-gpu PYPI version =2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - d3m-simon =1.2.5 - easyquake =1.3.0, =1.4.0 Source cves: CVE-2021-29538 Source advisory: OSV:GHSA-J8QC-5FQR-52FP...

accuinsight (>=1.0.47 <=1.0.61), alphad3m (>=0.10.0 <=0.10.0.dev1) +88 more potentially affected by CVE-2021-29530 via tensorflow (>=2.2.0 <=2.2.2)

tensorflow PYPI version =2.2.0, =1.0.47, =0.10.0, =0.5.0, =0.2.0, =0.0.6, =1.2.0, =1.0.0, =0.0.15, =0.0.16 and more Source cves: CVE-2021-29530 Source advisory: OSV:GHSA-XCWJ-WFCM-M23C...

CVE-2021-25929

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting since...

GHSA-VH59-V9R5-4MH4 Cross-site scripting in jspdf

Affected versions of this package are vulnerable to Cross-site Scripting XSS. It's possible to inject JavaScript code via the html method...

complaintclassify (=0.0.9) potentially affected by CVE-2021-29580 via tensorflow-cpu (=2.4.0)

tensorflow-cpu PYPI version =2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - complaintclassify =0.0.9 Source cves: CVE-2021-29580 Source advisory: OSV:PYSEC-2021-508...

complaintclassify (=0.0.9) potentially affected by CVE-2021-29539 via tensorflow-cpu (=2.4.0)

tensorflow-cpu PYPI version =2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - complaintclassify =0.0.9 Source cves: CVE-2021-29539 Source advisory: OSV:PYSEC-2021-467...

d3m-simon (=1.2.5), easyquake (>=1.3.0 <=1.4.0) potentially affected by CVE-2021-29603 via tensorflow-gpu (=2.2.0)

tensorflow-gpu PYPI version =2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - d3m-simon =1.2.5 - easyquake =1.3.0, =1.4.0 Source cves: CVE-2021-29603 Source advisory: OSV:PYSEC-2021-729...

accuinsight (>=1.0.47 <=1.0.61), adapt-diagnostics (=1.2.0) +171 more potentially affected by CVE-2021-29552 via tensorflow (>=2.2.0 <=2.3.0)

tensorflow PYPI version =2.2.0, =1.0.47, =0.1.0, =0.10.0, =0.5.0, =0.0.1, =0.0.2 and more Source cves: CVE-2021-29552 Source advisory: OSV:PYSEC-2021-189...

pycnet-audio (>=0.5.1 <=0.5.8) potentially affected by CVE-2021-29527 via tensorflow-cpu (=2.2.0)

tensorflow-cpu PYPI version =2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - pycnet-audio =0.5.1, =0.5.8 Source cves: CVE-2021-29527 Source advisory: OSV:PYSEC-2021-455...

Exploit for Code Injection in Exiftool_Project Exiftool

Vulnerable Version 7.44 12.23 Reproduce $...

Prototype Pollution in templ8

All versions of package templ8 up to and including 0.0.44 are vulnerable to Prototype Pollution via the parse function...

@keep2zero/light (>=0.0.1 <=0.0.10), @logique/fastify-adapter (>=0.0.1 <=0.0.3-alpha.4) +9 more potentially affected by CVE-2020-8136 via fastify-multipart (>=0.2.0 <=0.8.2)

fastify-multipart NPM version =0.2.0, =0.0.1, =0.0.1, =0.0.1, =0.0.10, =1.0.20, =4.1.0, =9.0.0, =0.1.0, =5.4.1, =5.4.10 - nestjs-test =5.4.1 Source cves: CVE-2020-8136 Source advisory: OSV:GHSA-P9F8-GQJF-M75J...

Denial Of Service(DoS)

BIND is vulnerable to denial of service. When a vulnerable version of named receives a malformed IXFR triggers a flaw, the named process will terminate due to a failed assertion the next time the transferred secondary zone is refreshed...

Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8

Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 Vaadin versions 8.0.0 through 8.12.4 allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses. See CWE-400: Uncontrolled Resource...

CVE-2021-2321

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.20. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromis...

DEBIAN-CVE-2021-21202

Use after free in extensions in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension...