PT-2021-24340 · Hewlett Packard · Hpe Integrated Lights-Out 5 +1

Name of the Vulnerable Software and Affected Versions: Hewlett Packard Enterprise Integrated Lights-Out 5 affected versions not specified Description: A Cross Site Scripting XSS issue has been identified, along with other potential security vulnerabilities such as CR-LF injection, DOM XSS, and...

GNU LibreDWG 缓冲区错误漏洞

LibreDWG is a free C library for reading and writing DWG files. A heap buffer overflow vulnerability exists in GNU LibreDWG version 0.10.2641. An attacker can exploit this vulnerability via htmlescape ... /... /programs/escape.c:48 to exploit the vulnerability and cause a heap buffer overflow...

Red Hat Ceph Storage 注入漏洞

Red Hat Ceph Storage is a suite of scalable, open software-defined storage platforms from Red Hat USA. An injection vulnerability exists in Red Hat Ceph Storage RadosGW prior to version 14.2.21, which stems from a line break in the ExposeHeader tag in the CORS configuration file that generates a...

GNU LibreDWG 缓冲区错误漏洞

LibreDWG is a free C library for reading and writing DWG files. A heap buffer overflow vulnerability exists in GNU LibreDWG version 0.10.2641. An attacker can exploit this vulnerability via htmlescape ... /... /programs/escape.c:46 to exploit the vulnerability and cause a heap buffer overflow...

CVE-2021-32617

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An inefficient algorithm quadratic complexity was found in Exiv2 versions v0.27.3 and earlier. The inefficient algorithm is triggered when Exiv2 is used to write metadata int...

Design/Logic Flaw

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A read of uninitialized memory was found in Exiv2 versions v0.27.3 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying...

CVE-2021-29623

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A read of uninitialized memory was found in Exiv2 versions v0.27.3 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying...

CVE-2021-29623

CVE-2021-29623 affects the Exiv2 project (library and CLI) prior to version 0.27.4. A read of uninitialized memory occurs when Exiv2 reads metadata from a crafted image file, potentially allowing an attacker to leak a few bytes of stack memory. The vulnerability is fixed in 0.27.4. Affected scope...

The vulnerability of the command-line interface (CLI) of microprogramming software for Cisco Adaptive Security Appliance Software (ASA) and Cisco Firepower Threat Defense (FTD) allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the command-line interface CLI of Cisco Adaptive Security Appliance Software ASA and Cisco Firepower Threat Defense FTD lies in the lack of measures to neutralize the special elements used in operating system commands. Exploiting this vulnerability can allow attackers to...

HashiCorp Vault Information Disclosure Vulnerability (CNVD-2021-37053)

HashiCorp Vault is a private key access management tool from HashiCorp Hashicorp USA. An information disclosure vulnerability exists in HashiCorp vault-action prior to version 2.2.0, which stems from a multi-line secret that fails to properly register with GitHub Actions to mask logs, which can b...

Information Disclosure

github.com/hashicorp/vault-action/ is vulnerable to information disclosure. Multi-line secrets are not properly masked in its output and can potentially result in credentials disclosure...

OPENSUSE-SU-2021:0677-1 Security update for exim

This update for exim fixes the following issues: Exim was updated to exim-4.94.2 security update boo1185631 CVE-2020-28007: Link attack in Exim's log directory CVE-2020-28008: Assorted attacks in Exim's spool directory CVE-2020-28014: Arbitrary PID file creation CVE-2020-28011: Heap buffer overfl...

CVE-2021-32074

HashiCorp vault-action aka Vault GitHub Action before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking...

HashiCorp Vault 日志信息泄露漏洞

HashiCorp Vault is a private key access management tool from HashiCorp Hashicorp USA. An information disclosure vulnerability exists in HashiCorp vault-action prior to version 2.2.0, which stems from a multi-line secret that fails to properly register with GitHub Actions to mask logs, which can b...

Heap out-of-bounds read vulnerability in flvmeta (CNVD-2021-34779)

flvmeta is a command line utility. A heap out-of-bounds read vulnerability exists in flvmeta that can be exploited by an attacker to cause a denial of service...

Vault GitHub Action Did Not Correctly Mask Multi-Line Secrets In Output

Summary The Vault GitHub Action, vault-action or vault-secrets “vault-action”, did not correctly mask multi-line secrets in its output. This vulnerability, CVE-2021-32074, was fixed in vault-action 2.2.0. Background The Vault GitHub Action, vault-action...

CVE-2020-28198

The 'id' parameter of IBM Tivoli Storage Manager Version 5 Release 2 Command Line Administrative Interface, dsmadmc.exe is vulnerable to an exploitable stack buffer overflow. Note: the vulnerability can be exploited when it is used in "interactive" mode while, cause of a max number characters...

CVE-2021-1438

A vulnerability in Cisco Wide Area Application Services WAAS Software could allow an authenticated, local attacker to gain access to sensitive information on an affected device. The vulnerability is due to improper input validation and authorization of specific commands that a user can execute...

CVE-2020-28026

Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default configurations that enable Delivery Status Notification DSN. Certain uses of ORCPT= can place a newline into a spool header file, and indirectly allow unauthenticated remote attackers to execute arbitrary...

DEBIAN-CVE-2020-28021

Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. An authenticated remote SMTP client can insert newline characters into a spool file which indirectly leads to remote code execution as root via AUTH= in a MAIL FROM command...