All CVEs — page 757 of 854
The complete archive, 25 per page, newest first. 21350 records. Search instead.
The flaw allows attackers to supply malformed UTF-8 input to Net::IDN::Punycode's encode_punycode function, causing the Perl module to hang, crash, or return incorrect Punycode labels. This occurs because the module doesn't validate UTF-8 input before processing it, leading to undefined behavior in the XS backend on newer Perls and SIGBUS issues on older ones.
This vulnerability allows attackers to cause CPU exhaustion by exploiting a quadratic time complexity issue in Net::IDN::UTS46's punycode encoding. An attacker can craft malicious domain names that trigger expensive processing during DNS label validation, leading to denial of service.
The flaw allows a truncated label to be decoded incorrectly, leading to a different code point being derived. This can cause a sender to pick a label that resolves to a name on one installation but is rejected on another.
A CPU exhaustion vulnerability exists in Net::IDN::Punycode Perl module versions before 2.590, where decoding long domain labels causes quadratic time complexity due to inefficient buffer insertion operations. This allows attackers to consume excessive CPU resources when processing specially crafted domain names.
The flaw in Net::IDN::Punycode allows attackers to cause a denial of service by sending invalid labels, leading to excessive memory allocation.
The flaw allows heap use-after-free via a decoded code point that reallocates the output buffer, leading to potential memory corruption.
The flaw allows authenticated attackers with Subscriber-level access or higher to delete arbitrary files, potentially leading to remote code execution.
The flaw is a heap buffer overflow in the Net::IDN::Punycode Perl module, which can be exploited by attackers to corrupt the heap. This matters because it can lead to arbitrary code execution or other severe impacts.
The flaw allows unauthenticated users to inject malicious code into form submissions, which could then be executed in the browser of an admin user reviewing the submission, leading to potential remote code execution.
The Ninja Forms WordPress plugin has a PHP Object Injection vulnerability when exporting form submissions to CSV, allowing unauthenticated attackers to inject malicious objects that can be executed during deserialization. This creates a high-risk vector for remote code execution if POP chains exist in other plugins or themes.