Eaton Intelligent Power Manager Eval Injection Vulnerability

Eaton Intelligent Power Manager IPM is an intelligent power manager from Eaton Corporation that supports remote monitoring and management of multiple devices in a network from an interface. An Eval injection vulnerability exists in Eaton IPM versions prior to 1.69. The vulnerability arises becaus...

The vulnerability of the syntax analysis function for domain name records in the Simotics Connect 400 software and hardware suite allows a perpetrator to cause service interruptions.

The vulnerability of the syntax analysis function for DNS domain names in the Simotics Connect 400 software/hardware suite is related to reading data beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

The vulnerability of the syntax analysis function for domain name records in the Simotics Connect 400 software and hardware suite allows a perpetrator to cause service interruptions.

The vulnerability of the syntax analysis function for DNS domain names in the Simotics Connect 400 software and hardware suite is related to errors that occur when a line or array is terminated with the NULL character. Exploiting this vulnerability could allow an attacker to cause service...

SUSE: Security Advisory (SUSE-SU-2017:1317-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability in the implementation of syntactic analysis of user action lists in Qualcomm’s embedded software allows a perpetrator to execute arbitrary code or cause service failures.

The vulnerability of the syntax analysis implementation for the user action list in Qualcomm’s embedded software lies in the buffer overflow that occurs when the TLV Tag-length-value data writing method with the NDPE parameter is used. Exploiting this vulnerability allows a remote attacker to...

Debian DSA-4890-1 : ruby-kramdown - security update

Stan Hu discovered that kramdown, a pure Ruby Markdown parser and converter, performed insufficient namespace validation of Rouge syntax highlighting formatters. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory...

Siemens network software vulnerabilities, related to the lack of commas in the syntax of elements or search paths, allow attackers to execute arbitrary code with elevated privileges.

The vulnerability of Siemens network software is related to the absence of commas in the syntax of elements or search paths. Exploiting this vulnerability allows an attacker to execute arbitrary code with elevated privileges...

CVE-2021-23277 Improper Neutralization of Directives in Dynamically Evaluated Code

Eaton Intelligent Power Manager IPM prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax from users before using in the dynamic evaluation call in loadUserFile function under scripts/libs/utils.js. Successful exploitation can...

Debian: Security Advisory (DSA-4890-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 4890-1] ruby-kramdown security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4890-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 12, 2021 https://www.debian.org/security/faq -...

OESA-2021-1132 wireshark security update

Wireshark is an open source tool for profiling network traffic and analyzing packets. Such a tool is often referred to as a network analyzer, network protocol analyzer or sniffer. Wireshark, formerly known as Ethereal, can be used to examine the details of traffic at a variety of levels ranging...

OESA-2021-1136 hibernate3 security update

Security Fixes: A flaw was found in Hibernate ORM. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly...

CVE-2020-24391

mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769...

CVE-2020-24391

mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769...

[SECURITY] Fedora 32 Update: rubygem-kramdown-2.1.0-5.fc32

kramdown is yet-another-markdown-parser but fast, pure Ruby, using a strict syntax definition and supporting several common extensions...

mongo-express 安全漏洞

mongo-express is a lightweight, web-based management interface for interactively managing MongoDB databases. A security vulnerability exists in mongo-express before 1.0.0, which stems from implementing support for certain advanced syntax in an insecure manner...

Debian DSA-4878-1 : pygments - security update

Ben Caller discovered that Pygments, a syntax highlighting package written in Python 3, used regular expressions which could result in denial of service. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4878...

CVE-2020-24391: Undefined Security Weakness

mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769...

[SECURITY] [DSA 4878-1] pygments security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4878-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff March 27, 2021 https://www.debian.org/security/faq -...

Pygments Denial of Service Attack Vulnerability

Pygments is a general-purpose syntax highlighting tool for code hosting, forums, wikis, or other applications that need to beautify their source code. A denial of service vulnerability exists in Pygments versions 1.5 through 2.7.3. The vulnerability arises due to an infinite loop in the SMLLexer ...