4430 matches found
Django Channels leakage of session identifiers using legacy AsgiHandler
Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate request scopes in Channe...
USN-4766-1 commons-beanutils vulnerabilities
It was discovered that Apache Commons BeanUtils improperly handled certain input. An attacker could possibly use this vulnerability to cause a crash or execute arbitrary code...
Trojan.Win32.Siscos.bqe Insecure Permissions
Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/a41431099989b44359273216072f8295.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Trojan.Win32.Siscos.bqe Vulnerability: Insecure Permissions Description: creates an insecure dir nam...
CVE-2021-20232
A flaw was found in gnutls. A use after free issue in clientsendparams in lib/ext/presharedkey.c may lead to memory corruption and other potential consequences...
Memory corruption
A flaw was found in gnutls. A use after free issue in clientsendparams in lib/ext/presharedkey.c may lead to memory corruption and other potential consequences...
NewStart CGSL MAIN 6.02 : glibc Multiple Vulnerabilities (NS-SA-2021-0069)
The remote NewStart CGSL host, running version MAIN 6.02, has glibc packages installed that are affected by multiple vulnerabilities: - An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specifically, the backtrace function did not...
CVE-2021-21169
Out of bounds memory access in V8 in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page...
CVE-2021-20341
The CVE-2021-20341 issue affects IBM Cloud Pak for Multicloud Management Monitoring prior to version 2.2.6. It arises from returning potentially sensitive information in HTTP headers, which could enable subsequent attacks against the system. CVSS details in the sources indicate a medium severity ...
CVE-2021-21506
PowerScale OneFS 8.1.2,8.2.2 and 9.1.0 contains an improper input sanitization issue in its API handler. An un-authtenticated with ISIPRIVSYSSUPPORT and ISIPRIVLOGINPAPI privileges could potentially exploit this vulnerability, leading to potential privileges escalation...
IBM Cloud Pak System 安全漏洞
IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. The product supports deploying, managing and moving application environments across hybrid clouds. A security vulnerability exists in IBM Cloud Pak that stems from the return of...
CVE-2021-3404
In ytnef 1.9.3, the SwapWord function in lib/ytnef.c allows remote attackers to cause a denial-of-service and potentially code execution due to a heap buffer overflow which can be triggered via a crafted file...
CVE-2021-20350
IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194707...
CVE-2020-4863
CVE-2020-4863 affects IBM Engineering products (e.g., RDNG, DOORS Next, EWM, ETM, RQM, RTC and related IBM Jazz-based apps). The issue is a stored cross-site scripting in the Web UI that could lead to credentials disclosure in a trusted session. Affected versions span multiple 6.0.x–7.0.x release...
Gab's CTO Introduced a Critical Vulnerability to the Site
A review of the open source code shows an account under the executive's name made a mistake that could lead to the kind of breach reported this weekend...
SUSE-SU-2021:0687-1 Security update for gnome-autoar
This update for gnome-autoar fixes the following issues: - CVE-2020-36241: Skip problematic files that might be extracted outside of the destination dir to prevent potential directory traversal bsc1181930...
SUSE-SU-2021:0664-1 Security update for gnome-autoar
This update for gnome-autoar fixes the following issues: - CVE-2020-36241: Skip problematic files that might be extracted outside of the destination dir to prevent potential directory traversal bsc1181930...
CVE-2021-23962
Incorrect use of the '' method could have led to a user-after-poison and a potentially exploitable crash. This vulnerability affects Firefox 85...
CVE-2021-23962
Incorrect use of the '' method could have led to a user-after-poison and a potentially exploitable crash. This vulnerability affects Firefox 85...
The vulnerability of the authentication interface in Junos operating system routers of the EX, QFX, and SRX series allows a attacker to cause a service failure.
The vulnerability of the 802.1X authentication interface in Junos routing devices of the EX, QFX, and SRX series is related to the failure to release resources after their useful lifespan has ended. Exploiting this vulnerability can allow an attacker to cause service failures...