Archive
6 January 2021
Vulnerabilities first published on this day (UTC), newest first.
5 results · Clear filters · Feed
-
Medium 6.1CVE-2020-8264 EPSS 67%
Cross-site scripting in actionpack
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the contex…
-
Medium 5.7
Regular Expression Denial of Service in CairoSVG
CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular …
-
Medium 5.3
An attacker could send a specially crafted message to Crimson 3.1 (Build versions prior to 3119.001) that could leak ar…
-
Medium 6.5
The default configuration of Crimson 3.1 (Build versions prior to 3119.001) allows a user to be able to read and modify…
-
Medium 5.7
Infinite loop in parsing PNG files in
kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specifically, reader::read_from_container can cause an infinite loop when a crafted PNG file is given. This is…