234 matches found
GHSA-X5H4-9GQW-942J Improper Verification of Cryptographic Signature in aws-encryption-sdk
Impact This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated. In...
CVE-2021-20341
IBM Cloud Pak for Multicloud Management Monitoring 2.2 returns potentially sensitive information in headers which could lead to further attacks against the system. IBM X-Force ID: 194513...
IBM Cloud Pak System 安全漏洞
IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. The product supports deploying, managing and moving application environments across hybrid clouds. A security vulnerability exists in IBM Cloud Pak that stems from the return of...
Information Disclosure
libslirp is vulnerable to information disclosure. A buffer over-read in slirp.c allows reading of a certain amount of header data pass the total packet length...
PYSEC-2021-46
beforeupstreamconnection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean confusion and versus or...
Type confusion
beforeupstreamconnection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean confusion and versus or...
CVE-2021-3116
CVE-2021-3116 affects proxy.py’s AuthPlugin (http/proxy/auth.py) before version 2.3.1, where a boolean logic bug (and vs or) allows incorrect Proxy-Authorization header data to be accepted. This may impact authentication handling in proxy.py, as described in Red Hat OSV/NVD entries and related ad...
Vinades NukeViet SQL注入漏洞
Vinades NukeViet is an open source content management system CMS from Vinades Vietnam.Vinades NukeViet is vulnerable to a SQL injection vulnerability that originates from a SQL INSERT statement containing raw header data e.g., Referer and User-Agent from HTTP requests. No detailed vulnerability...
CVE-2019-7726: Improper Neutralization of Special Elements used in an SQL Command
modules/banners/funcs/click.php in NukeViet before 4.3.04 has a SQL INSERT statement with raw header data from an HTTP request e.g., Referer and User-Agent...
DEBIAN-CVE-2020-29129
ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length...
DEBIAN-CVE-2020-29130
slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length...
Buffer overflow
ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length...
CVE-2020-29129
ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length...
PT-2020-6961 · Libslirp +9 · Libslirp +9
Name of the Vulnerable Software and Affected Versions: libslirp versions 4.3.1 and earlier Description: The issue is related to a buffer over-read in the slirp.c component of the libslirp TCP-IP emulator. This occurs because the component attempts to read a certain amount of header data, even if ...
cryptacular: excessive memory allocation during a decode operation
CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data...
cryptacular: excessive memory allocation during a decode operation
CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data...
USN-4337-1 openjdk-8, openjdk-lts vulnerabilities
It was discovered that OpenJDK incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service while processing a specially crafted regular expression. CVE-2020-2754, CVE-2020-2755 It was discovered that OpenJDK incorrectly handled class...
Huawei EulerOS: Security Advisory for java-1.8.0-openjdk (EulerOS-SA-2018-1386)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
EulerOS 2.0 SP2 : java-1.7.0-openjdk (EulerOS-SA-2019-1846)
According to the versions of the java-1.7.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - OpenJDK: Incomplete enforcement of the trustURLCodebase restriction CVE-2018-3149 - OpenJDK: Leak of sensitive header data via HTTP...