Linux: netback fails to honor grant mapping errors

ISSUE DESCRIPTION XSA-362 tried to address issues here, but in the case of the netback driver the changes were insufficient: It left the relevant function invocation with, effectively, no error handling at all. As a result, memory allocation failures there could still lead to frontend-induced...

PT-2021-11001

Name of the Vulnerable Software and Affected Versions: ForkCMS versions prior to 5.8.3 Description: The issue allows an authenticated remote user to execute malicious code due to PHP object injection in the Ajax endpoint of the backend. Recommendations: For versions prior to 5.8.3, update to...

Authorization Bypass

fastify-reply-from is vulnerable to authorization bypass. An attacker is able to escape the prefix of the proxied backend service and access restricted service such as the parent of the base URL...

Prefix escape

Overview In fastify-http-proxy before version 4.3.1, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is...

GHSA-C4QR-GMR9-V23W Prefix escape

Impact By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N...

Remote code execution

Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the pretty option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was...

GHSA-QMW8-3V4G-GWJ4 Prefix escape

Impact By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N...

CVE-2021-21353 Remote code execution in pug

Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the pretty option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was...

CVE-2021-26855

Microsoft Exchange Server Remote Code Execution Vulnerability Recent assessments: wvu-r7 at March 09, 2021 7:01am UTC reported: CVE-2021-26855 CVE-2021-26855 is an SSRF vulnerability in Exchange that allows privileged access to Exchange’s backend resources, ultimately leading to pre-auth RCE when...

The vulnerability of Microsoft Exchange Server servers, related to insufficient validation of incoming requests, allows attackers to execute SSRF attacks.

The vulnerability of Microsoft Exchange Server lies in the insufficient checking of incoming requests. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack using specially crafted HTTPS requests that contain malicious cookie files named X-AnonResource-Backend and...

CVE-2021-21322

fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessin...

Arbitrary file download vulnerability in ZengCMS 1.0.0 backend

ZengCMS is a backend management system based on the latest TP6.0.x framework and Layui 2.5.x. ZengCMS1.0.0 backend has an arbitrary file download vulnerability, which can be exploited by attackers to obtain sensitive information...

PT-2021-14419

Name of the Vulnerable Software and Affected Versions fastify-http-proxy versions prior to 4.3.1 Description The issue allows an attacker to escape the prefix of the proxied backend service by crafting a specific URL. For example, if the base URL of the proxied server is /pub/, an attacker can...

Weak Password Vulnerability in XR20-GM of Hangzhou Dipu Technology Co.

XR20-GM is a new-generation router product based on the multi-core processor architecture of DIPTECH, which realizes the seamless integration of routing and switching with security and application delivery. The XR20-GM has a weak password vulnerability that can be exploited by attackers to log in...

Fedora 33 : xen (2021-47f53a940a)

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-47f53a940a advisory. - An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory accesses are bypassing the cache. This mea...

Fedora 33 : kernel (2021-7143aca8cb)

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-7143aca8cb advisory. - An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant...

Fedora 32 : kernel (2021-8d45d297c6)

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-8d45d297c6 advisory. - An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant...

fastify-reply-from 存在输入验证错误漏洞

Matteo Collina fastify-reply-from is Matteo Collina an open source application . It is used to forward the current http request to another server. A security vulnerability exists in fastify-reply-from before version 4.0.2, which can be exploited to escape the prefix of a proxy backend service by...

CVE-2021-27799

eanleadingzeroes in backend/upcean.c in Zint Barcode Generator 2.9.1 has a stack-based buffer overflow that is reachable from the C API through an application that includes the Zint Barcode Generator library code...

UBUNTU-CVE-2021-27799

eanleadingzeroes in backend/upcean.c in Zint Barcode Generator 2.9.1 has a stack-based buffer overflow that is reachable from the C API through an application that includes the Zint Barcode Generator library code...