CVE-2021-21322 Prefix escape

fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessin...

CVE-2020-28468

This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection SSTI, which can lead to remote code execution...

FFmpeg buffer overflow vulnerability (CNVD-2021-01998)

FFmpeg is a complete solution for recording, converting and streaming audio and video from the FFmpeg Ffmpeg team. A buffer overflow vulnerability exists in FFmpeg version 4.3.1, which stems from an error when calculating when to perform a memset zero operation. No details of the vulnerability ar...

CVE-2020-35965

decodeframe in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations...

CVE-2020-35964

trackheader in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bounds write because of incorrect extradata packing...

CVE-2020-35964

trackheader in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bounds write because of incorrect extradata packing...

CVE-2020-35964

trackheader in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bounds write because of incorrect extradata packing...

CVE-2020-35964

trackheader in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bounds write because of incorrect extradata packing...

Security Bulletin: Java vulnerability CVE-2020-2590 affecting IBM Streams

Summary Java vulnerability CVE-2020-2590 affecting IBM Streams. Please see below for more details. Vulnerability Details CVEID: CVE-2020-2590 DESCRIPTION: An unspecified vulnerability in Java SE related to the Java SE Security component could allow an unauthenticated attacker to cause no...

Security Bulletin: Java vulnerability CVE-2020-2601 affecting IBM Streams

Summary Java vulnerability CVE-2020-2601 affecting IBM Streams. Please see below for more details on this vulnerability. Vulnerability Details CVEID: CVE-2020-2601 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded Security component could allow a...

Security Bulletin: Apache Commons Codec could allow a remote attacker to obtain sensitive information, caused by the improper validation of input.

Summary Apache Commons Codec could allow a remote attacker to obtain sensitive information, caused by the improper validation of input. An attacker could exploit this vulnerability using a method call to obtain sensitive information. Vulnerability Details Third Party Entry: 177835 DESCRIPTION:...

Amazon Linux 2 : qemu (ALAS-2020-1570)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1570 advisory. A use-after-free issue was found in the SLiRP networking implementation of the QEMU emulator. The issue occurs in ipreass...

Improper Control of Generation of Code ('Code Injection')

Overview pwntools is a CTF framework and exploit development library. Written in Python, it is designed for rapid prototyping and development, and intended to make exploit writing as simple as possible. Affected versions of this package are vulnerable to Improper Control of Generation of Code 'Co...

libslirp 缓冲区错误漏洞

libslirp is a general-purpose TCP-IP emulator for managing virtual network services in a hypervisor. A buffer overread vulnerability exists in libslirp 4.3.1 and earlier versions of slirp.c. The vulnerability stems from slirp.c attempting to read a certain amount of header data even though the...

Intel Open WebRTC Toolkit Elevation of Privilege Vulnerability

Intel Open WebRTC Toolkit is a U.S. Intel Intel company based on the Gstreamer implementation of open source , cross-platform WebRTC client framework for end-to-end audio/video communication development toolkit . The toolkit is used to create high-performance, reliable and scalable real-time...

CVE-2020-12338

Insufficient control flow management in the Open WebRTC Toolkit before version 4.3.1 may allow an unauthenticated user to potentially enable escalation of privilege via network access...

UBUNTU-CVE-2020-26566

A Denial of Service condition in Motion-Project Motion 3.2 through 4.3.1 allows remote unauthenticated users to cause a webu.c segmentation fault and kill the main process via a crafted HTTP request...

CVE-2020-26566

A Denial of Service condition in Motion-Project Motion 3.2 through 4.3.1 allows remote unauthenticated users to cause a webu.c segmentation fault and kill the main process via a crafted HTTP request...

PT-2020-6180 · FFmpeg +5 · Ffmpeg +5

Name of the Vulnerable Software and Affected Versions: FFmpeg version 4.3.1 Description: The issue is related to the decode frame function in the libavcodec/exr.c component, which has an out-of-bounds write due to errors in calculations. This can be exploited by a remote attacker to cause a denia...

Fedora 33 : pdns (2020-7b1541266c)

Update to 4.3.1 - PowerDNS Security Advisory 2020-05 CVE-2020-17482 Release notes: https://doc.powerdns.com/authoritative/changelog/4.2.htmlchange-4.3.1 Security Advisory: https://docs.powerdns.com/authoritative/security-advisories/powerdns-a dvisory-2020-05.html Note that Tenable Network...