Improper Restriction of XML External Entity Reference in Apache NiFi

Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to disable external general entity parsing and disallow doctype declarations was applied on the Apache NiFi 1.6.0 release. Users running a prior...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (1.0.0), com.airbus-cyber-security.graylog:graylog-plugin-logging-alert (>=1.0.0, <=1.0.1) +6 more potentially affected by CVE-2018-11650 via org.graylog2:graylog2-server (>=2.0.0-alpha.1, <=2.4.3)

org.graylog2:graylog2-server MAVEN version =2.0.0-alpha.1, =1.0.0, =1.0.2, =2.2.0-alpha.1, =1.1.0, =2.2.0-beta.1, =2.2.0-alpha.1, =1.1.2, =2.2.0-alpha.1 Source cves: CVE-2018-11650 Source advisory: OSV:GHSA-H7G4-65MF-6MXH...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (1.0.0), com.airbus-cyber-security.graylog:graylog-plugin-logging-alert (>=1.0.0, <=1.0.1) +6 more potentially affected by CVE-2018-11650 via org.graylog2:graylog2-server (>=2.0.0-alpha.1, <=2.4.3)

org.graylog2:graylog2-server MAVEN version =2.0.0-alpha.1, =1.0.0, =1.0.2, =2.2.0-alpha.1, =1.1.0, =2.2.0-beta.1, =2.2.0-alpha.1, =1.1.2, =2.2.0-alpha.1 Source cves: CVE-2018-11650 Source advisory: GHSA-H7G4-65MF-6MXH...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (1.0.0), com.airbus-cyber-security.graylog:graylog-plugin-logging-alert (>=1.0.0, <=1.0.1) +6 more potentially affected by CVE-2018-14380 via org.graylog2:graylog2-server (>=2.0.0-alpha.1, <=2.4.5)

org.graylog2:graylog2-server MAVEN version =2.0.0-alpha.1, =1.0.0, =1.0.2, =2.2.0-alpha.1, =1.1.0, =2.2.0-beta.1, =2.2.0-alpha.1, =1.1.2, =2.2.0-alpha.1 Source cves: CVE-2018-14380 Source advisory: OSV:GHSA-38HF-XJMX-JRH8...

GHSA-W3J5-Q8F2-3CQQ Concurrent Execution using Shared Resource with Improper Synchronization in Apache Tomcat

A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn...

CVE-2022-29792

The chip component has a vulnerability of disclosing CPU SNs.Successful exploitation of this vulnerability may affect data confidentiality...

GHSA-9HG2-395J-83RM Expected Behavior Violation in Apache Tomcat

In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in t...

GHSA-7CWJ-J333-X7F7 Uncontrolled Resource Consumption in Apache ZooKeeper

Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10,...

DEBIAN-CVE-2022-21151

Processor optimization removal or modification of security-critical code for some IntelR Processors may allow an authenticated user to potentially enable information disclosure via local access...

CVE-2021-33117

Improper access control for some 3rd Generation IntelR XeonR Scalable Processors before BIOS version MR7, may allow a local attacker to potentially enable information disclosure via local access...

CVE-2021-0159

Improper input validation in the BIOS authenticated code module for some IntelR Processors may allow a privileged user to potentially enable aescalation of privilege via local access...

Information disclosure

Processor optimization removal or modification of security-critical code for some IntelR Processors may allow an authenticated user to potentially enable information disclosure via local access...

CVE-2022-21151

Processor optimization removal or modification of security-critical code for some IntelR Processors may allow an authenticated user to potentially enable information disclosure via local access...

UBUNTU-CVE-2022-21151

Processor optimization removal or modification of security-critical code for some IntelR Processors may allow an authenticated user to potentially enable information disclosure via local access...

CVE-2021-0188

Return of pointer value outside of expected range in the BIOS firmware for some IntelR Processors may allow a privileged user to potentially enable aescalation of privilege via local access...

CVE-2021-0159

CVE-2021-0159 concerns Intel BIOS firmware: improper input validation in the BIOS authenticated code module for certain Intel CPUs may allow a local privileged user to escalate privileges. The vulnerability is documented by Intel’s advisory INTEL-SA-00601 (and related Intel security notes) and su...

CVE-2021-33103

Unintended intermediary in the BIOS authenticated code module for some IntelR Processors may allow a privileged user to potentially enable aescalation of privilege via local access...

CVE-2021-0190

CVE-2021-0190 is an Intel BIOS/BIOS-authenticated-code vulnerability: uncaught exceptions in BIOS firmware may allow a locally privileged user to escalate privileges. Public sources in the connected documents identify this as a local-privilege-escalation issue affecting Intel CPUs, with several v...

CVE-2021-0153

CVE-2021-0153 describes an out-of-bounds write in the BIOS firmware for some Intel processors that could allow a locally authenticated attacker to escalate privileges. The Intel advisory (INTEL-SA-00601) confirms a BIOS/firmware issue with escalation potential and recommends vendor-provided BIOS ...

CVE-2022-21151

Processor optimization removal or modification of security-critical code for some IntelR Processors may allow an authenticated user to potentially enable information disclosure via local access...