CVE-2021-22946

A user can tell curl = 7.20.0 and = 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server --ssl-reqd on the command line orCURLOPTUSESSL set to CURLUSESSLCONTROL or CURLUSESSLALL withlibcurl. This requirement could be bypassed if the server would return a...

WooCommerce Product Table Lite < 2.4.0 - Reflected Cross-Site Scripting

The plugin does not escape the pricerangemin and pricerangemax parameters before outputting them back in attributes, leading a Reflected Cross-Site Scripting issue PoC On a page where there is a Product Table with a Price filter, append the following payload to the min and max price...

EulerOS 2.0 SP5 : squid (EulerOS-SA-2021-2519)

According to the versions of the squid package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it allows a denial of service. When resolving a...

squid security update

7:3.5.20-17.0.1 - Mutiple CVE fixes for squid Orabug: 33146289 - Resolves: CVE-2021-28651 squid: Bug 5104: Memory leak in RFC 2169 response parsing 778 - Resolves: CVE-2021-28652 squid: Bug 5106: Broken cache manager URL parsing 788 - Resolves: CVE-2021-31806,31807,31808 squid: Handle more Range...

Underscore.js 1.3.2 < 1.12.1 Arbitrary Code Injection

According to its self-reported version number, Underscore.js is 1.3.2 prior to 1.12.1 or 1.13.x prior to 1.13.0-2. Therefore, it may be affected by an arbitrary code injection via the template function when the variable option is taken from .templateSettings. Note that the scanner has not tested...

PT-2021-11026 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions 2.3.2 through 2.6 Description: A Server Side Request Forgery SSRF issue exists via the email function. When writing an email in an editor, it is possible to upload pictures from remote websites. Recommendations: For version...

CLSA-2021-1632262184 Fix of CVE: CVE-2021-2388

Fix CVE-2021-2388 OpenJDK: Incorrect comparison during range check elimination...

Fix of CVE: CVE-2021-2388

Fix CVE-2021-2388 OpenJDK: Incorrect comparison during range check elimination...

CLSA-2021-1632261839 Fix of CVE: CVE-2020-29661, CVE-2019-19532, CVE-2020-25656, CVE-2020-25211

CKSIX-277: CVE-2020-29661: tty: Fix -pgrp locking in tiocspgrp - CKSIX-277: CVE-2020-25656: vt: keyboard, extend funcbuflock to readers - CKSIX-277: CVE-2020-25656: tty/vt: fix write/write race in ioctlKDSKBSENT handler - CKSIX-277: CVE-2020-25656: vt: keyboard, simplify vtkdgkbsent - CKSIX-277:...

CLSA-2021-1632261812 Fix of CVE: CVE-2020-25211, CVE-2020-25656, CVE-2019-19532, CVE-2020-29661

CKSIX-277: CVE-2020-29661: tty: Fix -pgrp locking in tiocspgrp - CKSIX-277: CVE-2020-25656: vt: keyboard, extend funcbuflock to readers - CKSIX-277: CVE-2020-25656: tty/vt: fix write/write race in ioctlKDSKBSENT handler - CKSIX-277: CVE-2020-25656: vt: keyboard, simplify vtkdgkbsent - CKSIX-277:...

ceres-executor (>=0.1.0, <=0.2.0), inkpad-executor (0.1.0) +21 more potentially affected by CVE-2021-39216 +2 more via wasmtime (>=0.26.1, <=0.29.0)

wasmtime CARGO version =0.26.1, =0.1.0, =0.2.0, =0.1.2, =0.2.2, =0.3.0, =0.28.0, =0.26.0, =0.26.0, =0.27.0 and more Source cves: CVE-2021-39216, CVE-2021-39218, CVE-2021-39219 Source advisory: OSV:GHSA-4873-36H9-WV49...

@asephermann/capacitor-filechooser (0.0.1), @jewel998/mock-location (>=0.0.9, <=0.0.10) +53 more potentially affected by unknown CVE via mixme (>=0.0.1, <=0.4.0)

mixme NPM version =0.0.1, =0.0.9, =1.0.1, =0.0.1, =0.9.3-alpha.5, =0.0.1-alpha.1, =0.9.7-alpha.0, =0.8.1-alpha.0, =0.0.1-alpha.1, =0.2.1-alpha.1, =0.0.2-alpha.0, =0.0.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-84P7-FH9C-6G8H...

CVE-2020-21529

In transfig's fig2dev 3.2.7b it is possible for an attacker to create a specially crafted file that causes a stack buffer overflow due to improper range checks. This leads to a denial of service, impacting availability of the program...

Tremor 资源管理错误漏洞

Tremor is an open source event processing system for unstructured data. A resource management error vulnerability exists in Tremor Tremor-runtime, which arises when the product causes access to freed memory when using patch or merge on a state and assigning the result back to the state state. The...

DEBIAN-CVE-2021-41079

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service...

ALPINE-CVE-2021-36160

A carefully crafted request uri-path can cause modproxyuwsgi to read above the allocated memory and crash DoS. This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 inclusive...

CVE-2021-36160

A carefully crafted request uri-path can cause modproxyuwsgi to read above the allocated memory and crash DoS. This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 inclusive...

Apache HTTP Server 缓冲区错误漏洞

Apache HTTP Server is an open source web server from the Apache Foundation. Apache HTTP Server versions 2.4.30 to 2.4.48 contain a denial-of-service vulnerability that stems from a network system or product that does not properly validate incoming data. An attacker could exploit this vulnerabilit...

The vulnerability of TCP/IP NicheLite and InterNiche, related to comparing numerical ranges without minimal checks, allows attackers to cause service failures.

The vulnerability of TCP/IP NicheLite and InterNiche relates to the comparison of numerical ranges without any minimal checks during HTTP requests processing. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Huawei EulerOS: Security Advisory for squid (EulerOS-SA-2021-2433)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...