[ASA-202102-20] python2-jinja: denial of service

Arch Linux Security Advisory ASA-202102-20 ========================================== Severity: Low Date : 2021-02-07 CVE-ID : CVE-2020-28493 Package : python2-jinja Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1523 Summary ======= The package python2-jinja befo...

PYSEC-2021-66

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the punctuationre regex operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to...

Jinja2 Resource Management Error Vulnerability

Jinja2 is a Python based template engine. It has full Unicode support and provides an optional sandboxed template execution environment. A resource management error vulnerability exists in jinja2 from 0.0.0 and before 2.11.3, which stems from a ReDOS vulnerability in regex...

ai.hyacinth.framework:core-service-discovery-server (=0.5.24), ai.lum:odinson-rest-api_2.12 (>=0.3.1 <=0.5.0) +2196 more potentially affected by CVE-2020-28491 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.10.0 <=2.11.3)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.10.0, =0.3.1, =j8.2.2.0, =2.8.0, =2.8.0, =2.8.0, =2.8.0, =0.1.2, =0.1.2, =0.2.0, =0.1.2, =0.2.5 and more Source cves: CVE-2020-28491 Source advisory: SNYK:JAVA-COMFASTERXMLJACKSONDATAFORMAT-1047329...

Icinga 2 < 2.12.0-rc1 Privilege Escalation Vulnerability

Icinga 2 is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:icinga:icinga2";...

SAP Cloud Connector Code Injection Vulnerability

SAP Cloud Connector is a connector for connecting to the SAP Cloud Platform from SAP Germany. A code injection vulnerability exists in SAP Cloud Connector versions prior to 2.11.3, which can be exploited by a remote attacker to execute the injected code and compromise the operation of the...

SAP Cloud Connector Authorization Issues Vulnerability

SAP Cloud Connector is a connector for connecting to the SAP Cloud Platform from SAP Germany. An authorization issue vulnerability exists in SAP Cloud Connector versions prior to 2.11.3, which stems from the program failing to perform any authentication and can be exploited by an attacker to...

CVE-2019-0246

SAP Cloud Connector, before version 2.11.3, does not perform any authentication checks for functionalities that require user identity...

CVE-2019-0247

SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application...

Code injection

SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application...

Authentication flaw

SAP Cloud Connector, before version 2.11.3, does not perform any authentication checks for functionalities that require user identity...

CVE-2019-0247

SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application...

[SECURITY] [DLA 416-1] eglibc security update

Package : eglibc Version : 2.11.3-4+deb6u11 CVE ID : CVE-2015-7547 Several vulnerabilities have been fixed in the Debian GNU C Library, eglibc: CVE-2015-7547 The Google Security Team and Red Hat discovered that the glibc host name resolver function, getaddrinfo, when processing AFUNSPEC queries f...

Debian DLA-230-1 : eglibc security update

Arjun Shankar of Red Hat discovered that gethostbynamer and related functions compute the size of an input buffer incorrectly if the passed-in buffer is misaligned. This results in a buffer overflow. For the oldoldstable distribution squeeze, this problem has been fixed in version 2.11.3-4+deb6u6...

JVN#34900750: EC-CUBE vulnerable to code injection

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a code injection vulnerability. Impact Arbitrary PHP code may be executed with the privilege of the application on the server where it resides. Solution Apply the update or patch Apply the updat...

DEBIAN-CVE-2010-4052

Stack consumption vulnerability in the regcomp implementation in the GNU C Library aka glibc or libc6 through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service resource exhaustion via a regular expression containing adjacent repetition operators, a...

Fedora 8 : phpMyAdmin-2.11.3-1.fc8 (2007-4334)

Upstream released 2.11.3 - Removed the RPM scriptlets doing httpd restarts 227025 - Patched an information disclosure known as CVE-2007-0095 221694 - Provide virtual phpmyadmin package and a httpd alias 231431 Note that Tenable Network Security has extracted the preceding description block...