XStream: Unsafe deserizaliation of javax.sql.rowset.BaseRowSet

A flaw was found in xstream. A remote attacker may be able to load and execute arbitrary code from a remote host only by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

VulnCheck KEV: CVE-2021-43890

Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability...

Security Bulletin: October 2020 :Multiple vulnerabilities in IBM Java Runtime affect CICS Transaction Gateway

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 7.0, 7.1 and 8.0 used by CICS Transaction Gateway. CICS Transaction Gateway has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2020-14583 DESCRIPTION: An unspecified vulnerability in Java SE...

CVE-2021-29114

A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confidentiality, integrity and availability of targeted services via specifically crafted queries...

CVE-2021-29114

A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confidentiality, integrity and availability of targeted services via specifically crafted queries...

The vulnerability of the FreeRDP remote desktop protocol lies in the reading beyond the permissible buffer data limit. This allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the FreeRDP remote desktop protocol lies in the reading of data from the buffer beyond its allowable limits. Exploiting this vulnerability allows a malicious actor to gain access to confidential data, compromise its integrity, and cause service failures...

Security Bulletin: CVE-2021-2161 may affect IBM® SDK, Java™ Technology Edition used by IBM Data Studio Client

Summary CVE-2021-2161 was disclosed in the Oracle April 2021 Patch Update. Vulnerability Details CVEID: CVE-2021-2161 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, high integrity...

The vulnerability of the sldns_str2wire_dname_buf_origin function in the DNS server Unbound allows a hacker to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the sldnsstr2wirednamebuforigin function in the DNS server’s Unbound component is related to integer overflow. Exploiting this vulnerability could allow a malicious actor to gain access to confidential data, compromise its integrity, and cause service failures...

ALPINE-CVE-2021-3672

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS Domain Name Servers can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as we...

xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl

A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality,...

Security Bulletin: A vulnerability in IBM Java SDK affects IBM Tivoli Netcool Impact (CVE-2021-2388, CVE-2021-2369, CVE-2021-2432)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 used by IBM Tivoli Netcool Impact. IBM Tivoli Netcool Impact has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2021-2388 DESCRIPTION: An unspecified vulnerability in Java SE related to the ...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. A security vulnerability exists in Huawei HarmonyOS, which provides a microkernel-based, fully-scoped distributed operating system. An attacker could exploit this vulnerability to cause an integrity impact...

flatpak: Sandbox bypass via recent VFS-manipulating syscalls

A flaw was found in the flatpak package. It is susceptible to a software flaw that can deceive portals and other host-OS services into treating the flatpak app as an ordinary, non-sandboxed host-OS process. This flaw allows the escalation of privileges that the corresponding services presume the...

The vulnerability of Google Chrome’s browser loading function, related to memory usage after it is released, allows a hacker to gain access to confidential data, compromise its integrity, and cause service interruptions.

The vulnerability of Google Chrome’s web browser loading function is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and even cause service interruptions through a specially created...

The vulnerability of the TabGroups component in the Google Chrome web browser, related to memory usage after it is released, allows a malicious actor to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the TabGroups component in the Google Chrome web browser relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service interruptions through a specially...

The vulnerability of the PM_io_parser::readVertex() function in the Nef_2/PM_io parser component of the CGAL algorithm library allows a perpetrator to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the PMioparser::readVertex function in the Nef2/PMio parser component of the CGAL algorithm library is related to a polygon processing error in Nef. Exploiting this vulnerability could allow an attacker to access confidential data, compromise its integrity, and even cause...

flatpak: Sandbox bypass via recent VFS-manipulating syscalls

A flaw was found in the flatpak package. It is susceptible to a software flaw that can deceive portals and other host-OS services into treating the flatpak app as an ordinary, non-sandboxed host-OS process. This flaw allows the escalation of privileges that the corresponding services presume the...

The vulnerability of the flatview_read_continue() module of the QEMU hardware emulation software lies in the ability to write beyond the buffer boundaries. This allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the flatviewreadcontinue module of the QEMU hardware emulation software is related to improper handling of write operations in the case of SDHCBLKSIZE. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and even cause...

The vulnerability of the Nef polygon function in the CGAL computational geometry algorithm library, which involves reading data beyond the permissible buffer limits, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Nef polygon function in the CGAL computational geometry algorithm library is related to reading data beyond the permissible buffer size. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and even cause servi...

CVE-2021-35612

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...