CVE-2021-20265

A flaw was found in the way memory resources were freed in the unixstreamrecvmsg function in the Linux kernel when a signal was pending. This flaw allows an unprivileged local user to crash the system by exhausting available memory. The highest threat from this vulnerability is to system...

Apache Oozie Competitive Conditions Vulnerability

Apache Oozie is an Apache Apache open source application. Provides a workflow scheduler system for managing Apache Hadoop job functions. Apache Oozie in version 5.2.1 before the existence of a security vulnerability , the vulnerability stems from the network system or product in the operation of...

NewStart CGSL MAIN 6.02 : spamassassin Multiple Vulnerabilities (NS-SA-2021-0070)

The remote NewStart CGSL host, running version MAIN 6.02, has spamassassin packages installed that are affected by multiple vulnerabilities: - In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the...

NewStart CGSL MAIN 6.02 : expat Multiple Vulnerabilities (NS-SA-2021-0083)

The remote NewStart CGSL host, running version MAIN 6.02, has expat packages installed that are affected by multiple vulnerabilities: - In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and...

Exploit for Server-Side Request Forgery in Microsoft

CVE-2021-26855-PoC PoC exploit code for CVE-2021-26855. Orig...

python-pygments: ReDoS in multiple lexers

A denial of service attack was discovered against pygments. Some of the regular expressions used to tokenise source code for highlighting have exponential complexity. A specially crafted input file could cause pygments to take effectively infinite time to parse, consuming CPU resources and denyin...

Aruba Networks AirWave Management Platform XML External Entity Injection Vulnerability

Aruba Networks AirWave Management Platform is a suite of network management software for multi-vendor management from Aruba Networks. The software provides real-time monitoring, proactive alerting and historical data reporting. An XML External Entity Injection XXE vulnerability exists in the web...

Multi-forest consideration for published resources in Citrix Cloud

How to configure multi forest user can access the published resource in Citrix Cloud...

The vulnerability in the socket implementation with address mapping AF_VSOCK in Linux kernel allows attackers to escalate their privileges.

The vulnerability in the socket implementation with AFVSOCK addressing net/vmwvsock/afvsock.c in the Linux kernel is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to gain increased privileges...

Security Bulletin: IBM MQ Appliance is affected by libexpat vulnerabilities (CVE-2018-20843, CVE-2019-15903)

Summary IBM MQ Appliance has resolved libexpat vulnerabilities. Vulnerability Details CVEID: CVE-2018-20843 DESCRIPTION: libexpat is vulnerable to a denial of service, caused by an error in the XML parser. By persuading a victim to open a specially-crafted file, a remote attacker could exploit th...

HarmonyOS Privilege Bypass Vulnerability

HarmonyOS is a distributed operating system for all scenarios developed by Huawei, a Chinese company. A privilege bypass vulnerability exists in a component API of HarmonyOS 2.0. A local attacker could exploit the vulnerability to repeatedly issue commands that could exhaust system service...

CVE-2021-26855

Microsoft Exchange Server Remote Code Execution Vulnerability Recent assessments: wvu-r7 at March 09, 2021 7:01am UTC reported: CVE-2021-26855 CVE-2021-26855 is an SSRF vulnerability in Exchange that allows privileged access to Exchange’s backend resources, ultimately leading to pre-auth RCE when...

CVE-2021-22294

A component API of the HarmonyOS 2.0 has a permission bypass vulnerability. Local attackers may exploit this vulnerability to issue commands repeatedly, exhausting system service resources...

CVE-2021-22294

HarmonyOS 2.0 contains a component API permission bypass vulnerability that allows a local attacker to issue commands repeatedly, exhausting system service resources. Affected element: HarmonyOS 2.0 component API. Impact: potential resource exhaustion on local access. Root cause described as a pe...

Information Disclosure

salt is vulnerable to information disclosure. Credentials are logged via the salt.modules.cmdmod module, potentially allowing an attacker to retrieve the confidential information and gain access to restricted resources...

The vulnerability of the SSH service on Cisco StarOS allows a hacker to trigger a service failure.

The vulnerability of the SSH service on Cisco StarOS is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

Blind SSRF in widgetConnector - CVE-2021-26072

Affected versions of Atlassian Confluence Server allow remote attackers to manipulate the content of internal network resources via a blind Server-Side Request Forgery SSRF vulnerability in the widgetconnector plugin. When running in an environment like Amazon EC2, this flaw may be used to access...

Denial Of Service (DoS)

matrix-synapse is vulnerable to denial of service. A malicious homeserver is able to redirect requests to a very large .well-known file that leads to a denial of service condition where homeservers will consume significantly more resources when requesting the malicious .well-known file...

[SECURITY] Fedora 33 Update: containernetworking-plugins-0.9.1-2.fc33

The CNI Container Network Interface project consists of a specification and libraries for writing plugins to configure network interfaces in Linux containers, along with a number of supported plugins. CNI concerns itself only with network connectivity of containers and removing allocated resourc ...

Fedora: Security Advisory for containernetworking-plugins (FEDORA-2021-fb466fb623)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...