Uncontrolled Memory Consumption in Django

Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format function...

GHSA-FVXV-9XXR-H7WJ Pyspark User Impersonation Vulnerability

When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1...

PT-2019-11313 · Jenkins · Jenkins Job Import Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Job Import Plugin versions 2.1 and earlier Description: The issue allows attackers with control over the HTTP server queried in preparation of job import to read arbitrary files and perform a denial of service attack. This is due to a...

PYSEC-2019-169

When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1...

[SECURITY] [DSA 4375-1] spice security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4375-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 29, 2019 https://www.debian.org/security/faq -...

XML Entity Expansion (XEE)

ruby is vulnerable to XML Entity Expansion XEE attacks. The vulnerability exists as the REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service memory consumption via a crafted XML document, aka an XML Enti...

CVE-2019-3498

In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.pagenotfound, leading to content spoofing in a 404 error page if a user fails to recognize th...

Spoofing

In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.pagenotfound, leading to content spoofing in a 404 error page if a user fails to recognize th...

CVE-2019-3498

In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.pagenotfound, leading to content spoofing in a 404 error page if a user fails to recognize th...

Core: Kestrel - WebSocket DoS via CancellationToken (CoreFX and ASP.NET)

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0548...

CVE-2019-0564

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0548...

CVE-2019-0548

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.2, ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0564...

CVE-2019-0548

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.2, ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0564...

CVE-2019-0564

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0548...

PT-2022-16713 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: gpac versions prior to 2.1-DEV Description: The issue is related to an Integer Overflow or Wraparound in the GitHub repository gpac/gpac. Recommendations: For versions prior to 2.1-DEV, update to version 2.1-DEV or later to resolve the issue...

PT-2023-15455 · Unknown +1 · Gpac Mp4Box +1

Name of the Vulnerable Software and Affected Versions: GPAC MP4box version 2.1-DEV-rev644-g5c4df2a67 Description: The issue is related to a Buffer Overflow in the gf bs read data function. No information is provided about the estimated number of potentially affected devices worldwide or real-worl...

PT-2022-27429 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: GPAC version 2.1-DEV-rev428-gcb8ae46c8-master Description: A stack overflow issue was discovered in GPAC via the function dimC box read at isomedia/box code 3gpp.c. This issue can be exploited, potentially leading to security breaches...

PT-2022-26725 · Gpac +2 · Gpac +2

Name of the Vulnerable Software and Affected Versions: GPAC version 2.1-DEV-rev368-gfd054169b-master Description: A segmentation violation was discovered in GPAC via the function BD CheckSFTimeOffset at /bifs/field decode.c. Recommendations: For GPAC version 2.1-DEV-rev368-gfd054169b-master,...

PT-2022-26722 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: GPAC version 2.1-DEV-rev368-gfd054169b-master Description: A segmentation violation was discovered in GPAC via the function gf isom meta restore items ref at /isomedia/meta.c. Recommendations: For GPAC version 2.1-DEV-rev368-gfd054169b-master...

PT-2023-1542 · Gpac +2 · Gpac +2

Name of the Vulnerable Software and Affected Versions: GPAC version 2.1-DEV-rev505-gb9577e6ad-master Description: The issue is related to a memory leak via the afrt box read function at box code adobe.c. This can be exploited by a remote attacker to cause a denial of service. The memory leak is d...