PT-2021-25031

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 2.6.37 through 5.12.8 Description The issue is related to an incorrect limit in the filelayout decode layout function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2021-25075

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 2.6.37 through 5.10.41 Description The issue is related to an incorrect limit in the filelayout decode layout function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2021-25132

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.193 Description The issue is related to an incorrect limit in the filelayout decode layout function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2021-25108

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.124 Description The issue is related to an incorrect limit in the filelayout decode layout function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2021-14969

Name of the Vulnerable Software and Affected Versions: Huawei Smartphone affected versions not specified Description: The issue is related to a Memory Buffer Improper Operation Limit vulnerability. Successful exploitation of this vulnerability may cause exceptions in image processing...

Regular Expression Denial Of Service (ReDoS)

is-email is vulnerable to regular expression denial of service. The vulnerability exists due to the system not limiting the length of the data sent to the parameter...

PT-2021-24353

Name of the Vulnerable Software and Affected Versions: AWS Encryption SDK for Java versions 2.0.0 through 2.2.0 AWS Encryption SDK for Java versions less than 1.9.0 Description: The issue concerns the incorrect validation of some invalid ECDSA signatures. This affects the integrity of the...

PT-2021-24508

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.32 Description: The issue is related to a potential divide error in the nft limit init function of the netfilter module. The actual impact and attack plausibility have not yet been proven. It was introduce...

Denial Of Service (DoS)

github.com/tendermint/tendermint is vulnerable to denial of service. Out-of-memory exceptions allows an attacker to crash the application due to lack of P2P connection requests limit...

Oracle Linux 8 : krb5 (ELSA-2021-1593)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-1593 advisory. - Add recursion limit for ASN.1 indefinite lengths CVE-2020-28196 Tenable has extracted the preceding description block directly from the Oracle Linux security...

AZL-44670 CVE-2021-32640 affecting package js-jquery 3.5.0-4

ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server. The vulnerability has been fixed in [email protected]...

UBUNTU-CVE-2021-32640

ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server. The vulnerability has been fixed in [email protected]...

krb5 security update

1.18.2-8 - Add recursion limit for ASN.1 indefinite lengths CVE-2020-28196 - Resolves: 1906492 1.18.2-7 - Document -k option in kvno1 synopsis - Resolves: 1869055 1.18.2-6 - Enable MD5 override for FIPS RADIUS - Resolves: 1872689 1.18.2-5.2 - Unify kvno option documentation - Resolves: 1869055...

bash security and bug fix update

4.4.19-14 - Fix hang when limit for nproc is very high Resolves: 1890888 4.4.19-13 - Correctly drop saved UID when effective UID is not equal to its real UID Resolves: 1793943...

Courier: 2 Bypass of #1067533 rate limit via X-Forwarded-For<space>: Source IP on ( www.trycourier.app )

A vulnerability with AWS API Gateway was uncovered that allowed rate limiting to be bypassed when the X-Forwarded-For headed was manipulated a string added to the header key I was able to bypass the rate limit by adding extra space before the colon X-Forwarded-For: 127.0.0.1. The actual bug was i...

Reddit: No rate limit leads to spaming post

Vulnerability description not provided...

CVE-2021-28903

A stack overflow in libyang = v1.0.225 can cause a denial of service through function lyxmlparsemem. lyxmlparseelem function will be called recursively, which will consume stack space and lead to crash...

Unbounded loop in _removeNft could lead to a griefing/DOS attack

Handle shw Vulnerability details Impact Griefing/DOS attack is possible when a malicious NFT contract sends many NFTs to the vault, which could cause excessive gas consumed and even transactions reverted when other users are trying to unlock or transfer NFTs. Proof of Concept 1. The function...

Unbounded loop in function transferERC721

Handle shw Vulnerability details Impact The function transferERC721 loops over an unbounded array, timelockERC721KeysnftContract, whose length never decreases but increases whenever the owner locks an ERC721 token. Therefore, the required gas for executing this loop grows over time and could reac...

Reddit: No Rate Limit on redditgifts gift when Adding Comment

Hi team, I hope this report should not be closed as INFORMATIVE Summary: The add comment endpoint was improperly rate-limited so the potential attacker could post a large number of comments, overloading the server . Description: The add comment endpoint has a speed limit, but the number is set to...