A reflected cross-site scripting (XSS) vulnerability in Cacti 0.8.7g and earlier allows unauthenticated remote attackers to inject arbitrary web script or HTML in the "ref" parameter at auth_changepassword.php.
File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of an Open Source project.
A use-after-free exists in Python through 3.9 via heappushpop in heapq.
read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.
The json2xml package through 3.12.0 for Python allows an error in typecode decoding enabling a remote attack that can lead to an exception, causing a denial of service.
Stack Overflow vulnerability in libsass 3.6.5 via the CompoundSelector::has_real_parent_ref function.
A heap buffer overflow in r_sleb128 function in radare2 5.4.2 and 5.4.0.
A heap buffer overflow in vax_opfunction in radare2 5.4.2 and 5.4.0.
A null pointer deference in __core_anal_fcn function in radare2 5.4.2 and 5.4.0.
A use after free in r_reg_get_name_idx function in radare2 5.4.2 and 5.4.0.