Search CVE reports
431 – 440 of 40627 results
Not in release
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
1 affected package
golang-golang-x-net-dev
| Package | 22.04 LTS |
|---|---|
| golang-golang-x-net-dev | Not in release |
Not in release
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
1 affected package
golang-golang-x-net-dev
| Package | 22.04 LTS |
|---|---|
| golang-golang-x-net-dev | Not in release |
Not in release
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
1 affected package
golang-golang-x-net-dev
| Package | 22.04 LTS |
|---|---|
| golang-golang-x-net-dev | Not in release |
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression...
1 affected package
nginx
| Package | 22.04 LTS |
|---|---|
| nginx | Needs evaluation |
shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match...
1 affected package
node-shell-quote
| Package | 22.04 LTS |
|---|---|
| node-shell-quote | Needs evaluation |
vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the application lacks a runtime check on the length of history entries in release...
1 affected package
vifm
| Package | 22.04 LTS |
|---|---|
| vifm | Needs evaluation |
For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.
4 affected packages
golang-go.crypto, snapd, lxd, google-guest-agent
| Package | 22.04 LTS |
|---|---|
| golang-go.crypto | Needs evaluation |
| snapd | Needs evaluation |
| lxd | Not in release |
| google-guest-agent | Needs evaluation |
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
4 affected packages
golang-go.crypto, snapd, lxd, google-guest-agent
| Package | 22.04 LTS |
|---|---|
| golang-go.crypto | Needs evaluation |
| snapd | Needs evaluation |
| lxd | Not in release |
| google-guest-agent | Needs evaluation |
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
4 affected packages
golang-go.crypto, snapd, lxd, google-guest-agent
| Package | 22.04 LTS |
|---|---|
| golang-go.crypto | Needs evaluation |
| snapd | Needs evaluation |
| lxd | Not in release |
| google-guest-agent | Needs evaluation |
[openpgp: Don't imply missing key flags from key type]
1 affected package
rust-sequoia-openpgp
| Package | 22.04 LTS |
|---|---|
| rust-sequoia-openpgp | Needs evaluation |