CVE-2022-41413

perfSONAR v4.x = v4.4.5 was discovered to contain a Cross-Site Request Forgery CSRF which is triggered when an attacker injects crafted input into the Search function...

perfSONAR 跨站请求伪造漏洞

perfSONAR is a widely deployed test and measurement infrastructure used by scientific networks and facilities around the world to monitor and ensure network performance. A security vulnerability exists in perfSONAR versions v4.x through v4.4.5 that stems from the inclusion of cross-site request...

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder such that a crafted unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1 3.10.9 3.9.16 3.8.16 and 3.7.16.

...

netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way

A flaw was found in the Netty's netty-codec due to unrestricted chunk lengths in the SnappyFrameDecoder. By sending a specially-crafted input, a remote attacker could cause excessive memory usage resulting in a denial of service...

CVE-2022-20834

Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface of an affected device. These vulnerabilities are due t...

Cross site scripting

Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface of an affected device. These vulnerabilities are due t...

Cross site scripting

Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface of an affected device. These vulnerabilities are due t...

Cross site scripting

Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface of an affected device. These vulnerabilities are due t...

EulerOS 2.0 SP9 : gcc (EulerOS-SA-2022-2764)

According to the versions of the gcc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In gcc, an internal compiler error in matchreload function at lra-constraints.c may cause a crash through a crafted input file. CVE-2020-35536 - In...

EulerOS 2.0 SP9 : gcc (EulerOS-SA-2022-2729)

According to the versions of the gcc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In gcc, an internal compiler error in matchreload function at lra-constraints.c may cause a crash through a crafted input file. CVE-2020-35536 - In...

Huawei EulerOS: Security Advisory for gcc (EulerOS-SA-2022-2729)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-20926

A vulnerability in the web management interface of the Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. The vulnerability is due to insufficient validation of user-supplied parameters for...

ALPINE-CVE-2022-45061

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA RFC 3490 decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often...

UBUNTU-CVE-2022-45061

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA RFC 3490 decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often...

Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : LibTIFF vulnerabilities (USN-5714-1)

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5714-1 advisory. It was discovered that LibTIFF incorrectly handled certain memory operations when using tiffcrop. An attacker could...

MGASA-2022-0410 Updated libtiff packages fix security vulnerability

There is a double free or corruption in rotateImage at tiffcrop.c:8839 found in libtiff 4.4.0rc1. CVE-2022-2519 A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage at tiffcrop.c:8621 that can cause program crash when reading a crafted input. CVE-2022-2520 It w...

fribidi: SEGV in fribidi_remove_bidi_marks

A segmentation fault SEGV flaw was found in the Fribidi package and affects the fribidiremovebidimarks function of the lib/fribidi.c file. This flaw allows an attacker to pass a specially crafted file to Fribidi, leading to a crash and causing a denial of service...

Denial Of Service (DoS)

libjpeg-turbo is vulnerable to denial of service. The vulnerability exists because of a null pointer dereference in jcopysamplerows when processed by libjpeg-turbo which allows an attacker to send a crafted input file causing an application crash...

HTMLMinifier Denial of Service Vulnerability

HTMLMinifier is a Javascript-based HTML compressor/minifier . A denial of service vulnerability exists in HTMLMinifier version 4.0.0, which stems from the program's improper use of regular expressions, and can be exploited by an attacker to cause a denial of service by sending specially crafted...

HTMLMinifier 资源管理错误漏洞

HTMLMinifier is a Javascript-based HTML compressor/minifier . A denial of service vulnerability exists in HTMLMinifier version 4.0.0, which stems from the program's improper use of regular expressions, and can be exploited by an attacker to cause a denial of service by sending specially crafted...