Search: com.py

A security exception crash was identified in the Checkstyle tool within the JavaLanguageParser.expr method, reported by OSS-Fuzz. The crash involves UTF-8 encoding operations in the Java base module. This issue is classified as medium severity and affects certain versions of Checkstyle. No CVSS score or detailed impact information is provided.

A security exception crash occurs in the Checkstyle tool within the JavaLanguageParser.expr method, as reported by OSS-Fuzz. The crash involves Java's HeapCharBuffer and CharBuffer.wrap methods. This issue was identified in a specific commit version of Checkstyle and is classified with medium severity.

An issue discovered in iSpyConnect.com Agent DVR 5.1.6.0 allows attackers to run arbitrary files by restoring a crafted backup file.

GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is present in https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That code joins the base directory with a user given string without checking if the final path is located outside the base directory. This vulnerability cannot be used to read the contents of files but could in theory be used to trigger a denial of service for the program. This issue has been addressed in version 3.1.37.

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.