Ecosystem
Hackage
36 known vulnerabilities.
Most affected packages
5 results · Clear filters · Feed
-
Medium 6.0
Arbitrary file write is possible in Pandoc when using PDF output or --extract-media with untrusted input
Pandoc is a Haskell library for converting from one markup format to another, and a command-line tool that uses this library. Starting in version 1.13 and prior to version 3.1.4, Pandoc is susceptible to an arbitrary file write vulnerability, which can be tri…
-
Medium 5.3
Quadratic complexity may lead to a denial of service in cmark-gfm
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity …
-
Medium 4.3
xml-conduit DOCTYPE Entity Expansion Parse.hs infinite loop
A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. I…
-
Medium 5.9
git-annex private data exfiltration to compromised remote
git-annex is vulnerable to a private data exposure and exfiltration attack. It could expose the content of files located outside the git-annex repository, or content from a private web server on localhost or the LAN.
-
Medium 5.9
git-annex GPG decryption attack via compromised remote
git-annex is vulnerable to an Information Exposure when decrypting files. A malicious server for a special remote could trick git-annex into decrypting a file that was encrypted to the user's gpg key. This attack could be used to expose encrypted data that wa…