CVE-2021-31845 Remote Code Execution in McAfee DLP Discover

A buffer overflow vulnerability in McAfee Data Loss Prevention DLP Discover prior to 11.6.100 allows an attacker in the same network as the DLP Discover to execute arbitrary code through placing carefully constructed Ami Pro .sam files onto a machine and having DLP Discover scan it, leading to...

McAfee DLPe Agent < 11.6.200 Buffer Overflow (SB10368)

The version of the McAfee Data Loss Prevention Endpoint DLPe Agent installed on the remote Windows host is prior to 11.6.200. It is, therefore, affected by a vulnerability caused by copying a buffer without first checking the size of the input. This can be exploited by an authenticated, local...

PT-2021-19546 · Mcafee · Mcafee Data Loss Prevention Endpoint

Name of the Vulnerable Software and Affected Versions: McAfee Data Loss Prevention DLP Endpoint for Windows versions prior to 11.6.200 Description: A buffer overflow issue allows a local attacker to execute arbitrary code with elevated privileges by placing carefully constructed Ami Pro .sam file...

McAfee Data Loss Prevention 安全漏洞

Mcafee McAfee Data Loss Prevention DLP is a data loss prevention suite from Mcafee, Inc. that includes components such as McAfee DLP Monitor, McAfee DLP Endpoint, and provides event management and reporting, synchronization of local and cloud DLP policies, and more. A security vulnerability exist...

McAfee Data Loss Prevention 安全漏洞

McAfee Data Loss Prevention Discover McAfee DLP Discover helps you locate and classify sensitive data, understand how it is used, and protect it. buffer overflow vulnerabilities exist in versions of McAfee Data Loss Prevention Discover prior to 11.6.100. Overflow vulnerability. The vulnerability...

Grafana -- Snapshot authentication bypass

Grafana Labs reports: Unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key If the snapshot "publicmode" configuration setting is set to true vs default of false,...

bind: Broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly

Incremental zone transfers IXFR provide a way of transferring changed portions of a zone between servers. An IXFR stream containing SOA records with an owner name other than the transferred zone's apex may cause the receiving named server to inadvertently remove the SOA record for the zone in...

Heap OOB in nested `tf.map_fn` with `RaggedTensor`s

Impact It is possible to nest a tf.mapfn within another tf.mapfn call. However, if the input tensor is a RaggedTensor and there is no function signature provided, code assumes the output is a fully specified tensor and fills output buffer with uninitialized contents from the heap: python import...

Multiple vulnerabilities in Navigate CMS

Overview Navigate CMS is an open source Contents Management System CMS provided by Naviwebs S.C. Navigate CMS contains multiple vulnerabilities listed below. Reflected cross-site scripting in the Help feature CWE-79 Reflected cross-site scripting CWE-79 - CVE-2021-36454 SQL injection CWE-89 -...

How to Reduce Exchange Server Downtime in Case of a Disaster?

Exchange Server downtime may occur at any point in time due to several reasons, such as malware attack, server crash, database corruption, and hardware or software-related issues/incompatibility. However, downtime can impact productivity and lead to data loss that can have severe implications on...

PT-2021-6615 · Node.Js +6 · Node.Js +6

Name of the Vulnerable Software and Affected Versions: Node.js versions prior to 16.6.0 Node.js versions prior to 14.17.4 Node.js versions prior to 12.22.4 Description: The issue is related to the Node.js dns library, which lacks proper input validation of host names returned by Domain Name...

PYSEC-2021-790

TensorFlow is an end-to-end open source platform for machine learning. In affected versions it is possible to nest a tf.mapfn within another tf.mapfn call. However, if the input tensor is a RaggedTensor and there is no function signature provided, code assumes the output is a fully specified tens...

Design/Logic Flaw

TensorFlow is an end-to-end open source platform for machine learning. In affected versions it is possible to nest a tf.mapfn within another tf.mapfn call. However, if the input tensor is a RaggedTensor and there is no function signature provided, code assumes the output is a fully specified tens...

CVE-2021-37679

TensorFlow CVE-2021-37679 concerns a vulnerability in nested tf.map_fn with RaggedTensor inputs. The root cause is in the conversion from a Variant tensor to a RaggedTensor: the implementation does not verify that all inner shapes match, which can produce extra dimensions and allow leakage of hea...

CVE-2021-37679

TensorFlow is an end-to-end open source platform for machine learning. In affected versions it is possible to nest a tf.mapfn within another tf.mapfn call. However, if the input tensor is a RaggedTensor and there is no function signature provided, code assumes the output is a fully specified tens...

CVE-2021-1109

NVIDIA camera firmware contains a multistep, timing-related vulnerability where an unauthorized modification by camera resources may result in loss of data integrity or denial of service across several streams...

Integer overflow

NVIDIA Linux kernel distributions contain a vulnerability in FuSa Capture VI/ISP, where integer underflow due to lack of input validation may lead to complete denial of service, partial integrity, and serious confidentiality loss for all processes in the system...

UC San Diego Health Breach Tied to Phishing Attack

Authorities at the University of California San Diego Health reported a phishing attack led to a major breach of its network, which allowed an adversary to gain access to sensitive patient, student and employee data. A Wednesday notice from UCSD Health explains the attack occurred between Dec. 2,...

CVE-2021-32796

A flaw was found in nodejs-xmldom. The xmldom library is an open-source pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Xmldom does not correctly escape special characters when serializing elements removed from their ancestor. This flaw may lead to...

CVE-2021-1091

NVIDIA GPU Display driver for Windows contains a vulnerability where an unprivileged user can create a file hard link that causes the driver to overwrite a file that requires elevated privilege to modify, which could lead to data loss or denial of service...