Search CVE reports
491 – 500 of 50584 results
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
1 affected package
golang-golang-x-net-dev
| Package | 16.04 LTS |
|---|---|
| golang-golang-x-net-dev | Needs evaluation |
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This...
1 affected package
golang-golang-x-net-dev
| Package | 16.04 LTS |
|---|---|
| golang-golang-x-net-dev | Needs evaluation |
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
1 affected package
golang-golang-x-net-dev
| Package | 16.04 LTS |
|---|---|
| golang-golang-x-net-dev | Needs evaluation |
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
1 affected package
golang-golang-x-net-dev
| Package | 16.04 LTS |
|---|---|
| golang-golang-x-net-dev | Needs evaluation |
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
1 affected package
golang-golang-x-net-dev
| Package | 16.04 LTS |
|---|---|
| golang-golang-x-net-dev | Needs evaluation |
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression...
1 affected package
nginx
| Package | 16.04 LTS |
|---|---|
| nginx | Fixed |
For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.
4 affected packages
golang-go.crypto, snapd, lxd, google-guest-agent
| Package | 16.04 LTS |
|---|---|
| golang-go.crypto | Needs evaluation |
| snapd | Needs evaluation |
| lxd | Needs evaluation |
| google-guest-agent | — |
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
4 affected packages
golang-go.crypto, snapd, lxd, google-guest-agent
| Package | 16.04 LTS |
|---|---|
| golang-go.crypto | Needs evaluation |
| snapd | Needs evaluation |
| lxd | Needs evaluation |
| google-guest-agent | — |
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
4 affected packages
golang-go.crypto, snapd, lxd, google-guest-agent
| Package | 16.04 LTS |
|---|---|
| golang-go.crypto | Needs evaluation |
| snapd | Needs evaluation |
| lxd | Needs evaluation |
| google-guest-agent | — |
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.
4 affected packages
golang-go.crypto, snapd, lxd, google-guest-agent
| Package | 16.04 LTS |
|---|---|
| golang-go.crypto | Needs evaluation |
| snapd | Needs evaluation |
| lxd | Needs evaluation |
| google-guest-agent | — |