bind: An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself

A flaw was found in bind. The way DNAME records are processed may trigger the same RRset to the ANSWER section to be added more than once which causes an assertion check to fail. The highest threat from this flaw is to system availability...

bind: An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself

A flaw was found in bind. The way DNAME records are processed may trigger the same RRset to the ANSWER section to be added more than once which causes an assertion check to fail. The highest threat from this flaw is to system availability...

Command Injection

Amendment This issue was found to be a duplicate. The original vulnerability with details can be found here...

CVE-2021-27802

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-24177. Reason: This candidate is a duplicate of CVE-2021-24177. Notes: All CVE users should reference CVE-2021-24177 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage...

Allowing duplicated anchors could cause bias on anchor price.

Handle shw Vulnerability details Impact In Router.sol, the setup of the five anchors can be interrupted by anyone adding a new anchor due to the lack of access control of the listAnchor function. Also, duplicate anchors are allowed. If the same anchor is added three times, then this anchor biases...

CVE-2021-3036

An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where secrets in PAN-OS XML API requests are logged in cleartext to the web server logs when the API is used incorrectly. This vulnerability applies only to PAN-OS appliances that are configured to...

DEBIAN-CVE-2021-31262

The AV1DuplicateConfig function in GPAC 1.0.1 allows attackers to cause a denial of service NULL pointer dereference via a crafted file in the MP4Box command...

UBUNTU-CVE-2021-31262

The AV1DuplicateConfig function in GPAC 1.0.1 allows attackers to cause a denial of service NULL pointer dereference via a crafted file in the MP4Box command...

GPAC 代码问题漏洞

GPAC is a multimedia framework for rich media and distributed under the LGPL license. A null pointer dereference vulnerability exists in the AV1DuplicateConfig function in GPAC version 1.0.1. An attacker could exploit this vulnerability via specially crafted files to cause a denial of service...

WordPress Download Manager < 3.1.18 - Unauthorised Download Duplication

The duplicate method, hooked to the admininit action did not have any CSRF and authorisation checks, allowing unauthorised users such as unauthenticated ones to duplicate arbitrary downloads PoC As an unauthenticated or authenticated user, open the following URL to duplicate the Download with id...

Cross-site Request Forgery (CSRF)

Amendment This issue was found to be a duplicate. The original vulnerability with details can be found here...

CVE-2021-28421

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-21417. Reason: This candidate is a duplicate of CVE-2021-21417. Notes: All CVE users should reference CVE-2021-21417 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage...

UBUNTU-CVE-2021-28421

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-21417. Reason: This candidate is a duplicate of CVE-2021-21417. Notes: All CVE users should reference CVE-2021-21417 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental...

CVE-2021-28421

FluidSynth contains a use-after-free in sfloader/fluid_sffile.c triggered while parsing SoundFont 2 files. This can allow remote code execution or denial of service if a specially crafted SoundFont is loaded. Remediation per connected sources includes upgrading to patched releases (e.g., FluidSyn...

CVE-2021-21640

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create views with invalid or already-used names...

OESA-2021-1117 tomcat security update

The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open developmen...

function buyBond charges msg.sender twice

Email address [email protected] Handle paulius.eth Eth address 0x523B5b2Cc58A818667C22c862930B141f85d49DD Vulnerability details function buyBond transfers amount from msg.sender twice: Fundfund.depositFormsg.sender, issuer, amount; ... collectTokenissuer, msg.sender, amount; Impact This makes th...

View name validation bypass

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name. When a form to create a view is submitted, the name is included twice in the submission. One instance is validated, but the other instance is used to create the value. This...

Jenkins 安全漏洞

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . LTS is a long-term support for...

Amazon Linux AMI : tomcat8 (ALAS-2021-1491)

The version of tomcat8 installed on the remote host is prior to 8.5.63-1.87. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1491 advisory. A deserialization flaw was discovered in Apache Tomcat's use of a FileStore. Under specific circumstances, an attacker...