Skip to content
OpenAdvisories

Archive

6 January 2021

Vulnerabilities first published on this day (UTC), newest first.

5 results · Clear filters · Feed

  • Medium 6.1
    CVE-2020-8264 EPSS 67%

    Cross-site scripting in actionpack

    In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the contex…

  • Medium 5.7

    Regular Expression Denial of Service in CairoSVG

    CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular …

  • Medium 5.3

    An attacker could send a specially crafted message to Crimson 3.1 (Build versions prior to 3119.001) that could leak ar…

  • Medium 6.5

    The default configuration of Crimson 3.1 (Build versions prior to 3119.001) allows a user to be able to read and modify…

  • Medium 5.7

    Infinite loop in parsing PNG files in

    kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specifically, reader::read_from_container can cause an infinite loop when a crafted PNG file is given. This is…