CVE-2021-23371: Undefined Security Weakness

This affects the package chrono-node before 2.2.4. It hangs on a date-like string with lots of embedded spaces...

Npm chrono-node security vulnerability

Npm chrono-node is an application from Npm USA. Used to handle most date/time formats and extract information from any given text. A security vulnerability exists in Chrono-node prior to version 2.2.4, which stems from the program hanging on date-like strings with a large number of embedded space...

SNOWCRASH - A Polyglot Payload Generator

SNOWCRASH creates a script that can be launched on both Linux and Windows machines. Payload selected by the user in this case combined Bash and Powershell code is embedded into a single polyglot template, which is platform-agnostic. There are few payloads available, including command execution,...

org.codehaus.cargo:cargo-jetty-10-deployer (>=1.8.3, <=1.10.30), org.eclipse.jetty.demos:demos-jetty-embedded (>=10.0.0, <=10.0.1) +4 more potentially affected by CVE-2021-28163 via org.eclipse.jetty:jetty-deploy (>=10.0.0, <=10.0.1)

org.eclipse.jetty:jetty-deploy MAVEN version =10.0.0, =1.8.3, =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.0.1 Source cves: CVE-2021-28163 Source advisory: GHSA-J6QJ-J888-VVGQ...

org.codehaus.cargo:cargo-jetty-11-deployer (>=1.10.9, <=1.10.30), org.codehaus.cargo:cargo-jetty-11-onwards-deployer (>=1.8.3, <=1.10.8) +5 more potentially affected by CVE-2021-28163 via org.eclipse.jetty:jetty-deploy (>=11.0.0, <=11.0.1)

org.eclipse.jetty:jetty-deploy MAVEN version =11.0.0, =1.10.9, =1.8.3, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.1 Source cves: CVE-2021-28163 Source advisory: OSV:GHSA-J6QJ-J888-VVGQ...

org.codehaus.cargo:cargo-jetty-11-deployer (>=1.10.9, <=1.10.30), org.codehaus.cargo:cargo-jetty-11-onwards-deployer (>=1.8.3, <=1.10.8) +5 more potentially affected by CVE-2021-28163 via org.eclipse.jetty:jetty-deploy (>=11.0.0, <=11.0.1)

org.eclipse.jetty:jetty-deploy MAVEN version =11.0.0, =1.10.9, =1.8.3, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.1 Source cves: CVE-2021-28163 Source advisory: MEND:CVE-2021-28163...

org.codehaus.cargo:cargo-jetty-10-deployer (>=1.8.3, <=1.10.30), org.eclipse.jetty.demos:demos-jetty-embedded (>=10.0.0, <=10.0.1) +4 more potentially affected by CVE-2021-28163 via org.eclipse.jetty:jetty-deploy (>=10.0.0, <=10.0.1)

org.eclipse.jetty:jetty-deploy MAVEN version =10.0.0, =1.8.3, =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.0.1 Source cves: CVE-2021-28163 Source advisory: MEND:CVE-2021-28163...

CVE-2021-21635

Jenkins REST List Parameter Plugin 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...

CVE-2021-21635: Improper Neutralization of Input During Web Page Generation

Jenkins REST List Parameter Plugin 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...

CVE-2021-1629

Tableau Server fails to validate certain URLs that are embedded in emails sent to Tableau Server users...

USN-4888-2: ldb vulnerabilities

USN-4888-1 fixed several vulnerabilities in ldb. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Douglas Bagnall discovered that ldb, when used with Samba, incorrectly handled certain LDAP attributes. A remote attacker could possibly use this issue t...

CVE-2021-1452 Cisco IOS XE ROM Monitor Software for Cisco Industrial Switches OS Command Injection Vulnerability

A vulnerability in the ROM Monitor ROMMON of Cisco IOS XE Software for Cisco Catalyst IE3200, IE3300, and IE3400 Rugged Series Switches, Cisco Catalyst IE3400 Heavy Duty Series Switches, and Cisco Embedded Services 3300 Series Switches could allow an unauthenticated, physical attacker to execute...

CVE-2021-1441 Cisco IOS XE Software Hardware Initialization Routines Arbitrary Code Execution Vulnerability

A vulnerability in the hardware initialization routines of Cisco IOS XE Software for Cisco 1100 Series Industrial Integrated Services Routers and Cisco ESR6300 Embedded Series Routers could allow an authenticated, local attacker to execute unsigned code at system boot time. This vulnerability is...

Cisco IOS XE ROM Monitor Software for Cisco Industrial Switches OS Command Injection Vulnerability

A vulnerability in the ROM Monitor ROMMON of Cisco IOS XE Software for Cisco Catalyst IE3200, IE3300, and IE3400 Rugged Series Switches, Cisco Catalyst IE3400 Heavy Duty Series Switches, and Cisco Embedded Services 3300 Series Switches could allow an unauthenticated, physical attacker to execute...

PT-2021-2627

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software for Cisco Catalyst IE3200, IE3300, and IE3400 Rugged Series Switches, Cisco Catalyst IE3400 Heavy Duty Series Switches, and Cisco Embedded Services 3300 Series Switches affected versions not specified Description: The...

CVE-2021-1441: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the hardware initialization routines of Cisco IOS XE Software for Cisco 1100 Series Industrial Integrated Services Routers and Cisco ESR6300 Embedded Series Routers could allow an authenticated, local attacker to execute unsigned code at system boot time. This vulnerability is...

HackerOne: Temporary banned user (from platform) is able to make submissions via embedded submission forms

Summary: Hello team! We have discovered issue which allows temporary banned user to submit new reports using embedded submission forms. The hacker can submit submissions via embedded forms using his/her email address. Once the ban is over the hacker can claim his/her report via invitation link...

network lookup_name DNS Parser Overflow DoS

The vulnerability of the dnsparsecallback function in the network/lookupname.c library for the C language, used in Linux-based operating systems, relates to the lack of restrictions on the number of addresses that can be entered. Exploiting this vulnerability could allow a remote attacker to caus...

Fedora: Security Advisory for arm-none-eabi-newlib (FEDORA-2021-0fa2f42d3c)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 34 Update: arm-none-eabi-newlib-4.1.0-1.fc34

Newlib is a C library intended for use on embedded systems. It is a conglomeration of several library parts, all under free software licenses that make them easily usable on embedded products...