Cross-site Scripting (XSS)

oro/platform is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in the translations management function which allows an attacker to inject javascript payload via the Upload translation file...

GHSA-RRGW-3HG3-9X8C XSS vulnerability in translations

Summary An attacker with admin privileges and access to Translations management functionality may add JS payload to translation values via: - Translation management UI. - Translations downloaded via the Crowdin service may also contain JS strings used for XSS attacks, for a successful attack...

CVE-2021-30269

Possible null pointer dereference due to lack of TLB validation for user provided address in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wired...

Experts Detail Logging Tool of DanderSpritz Framework Used by Equation Group Hackers

Cybersecurity researchers have offered a detailed glimpse into a system called DoubleFeature that's dedicated to logging the different stages of post-exploitation stemming from the deployment of DanderSpritz, a full-featured malware framework used by the Equation Group. DanderSpritz came to light...

CVE-2021-45906

OpenWrt 21.02.1 allows XSS via the NAT Rules Name screen...

The vulnerability of the Network Address Translation (NAT) technology implementation in Cisco IOS XE operating systems allows a hacker to induce a service failure.

The vulnerability of the Network Address Translation NAT technology implementation in Cisco IOS XE operating systems is related to resource management errors. Exploiting this vulnerability can allow an attacker to cause service interruptions...

netty: Request smuggling via content-length header

A flaw was found in Netty. There is an issue where the content-length header is not validated correctly if the request uses a single Http2HeaderFrame with the endstream set to true. This flaw leads to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. The...

CVE-2021-43811

Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An...

CVE-2021-43811

Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An...

PYSEC-2021-848

Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An...

Code injection

Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An...

PYSEC-2021-848

Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An...

CVE-2021-43811

Sockeye (PyTorch-based) vulnerable to code execution via unsafe YAML loading in model/data config files when using versions below 2.3.24; an attacker can inject malicious config, which executes locally when a user runs the model. The issue is fixed in 2.3.24. Practical impact is limited to users ...

The vulnerability of the implementation of Intel Virtualization Technology for Directed I/O (VT-d) in Xen hypervisors on Intel x86-based computers allows a hacker to enhance their privileges.

The vulnerability of the Intel Virtualization Technology for Directed I/O VT-d implementation in Xen hypervisors on Intel x86-based computers is related to incorrect processing of the address translation table. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2021-26340

A malicious hypervisor in conjunction with an unprivileged attacker process inside an SEV/SEV-ES guest VM may fail to flush the Translation Lookaside Buffer TLB resulting in unexpected behavior inside the virtual machine VM...

The vulnerability of the Session Initiation Protocol (SIP) implementation and the Network Address Translation (NAT) function of the Application Layer Gateway (ALG) in microprogrammable network interface devices from Cisco Adaptive Security Appliances (ASA) and Cisco Firepower Threat Defense (FTD) allows attackers to circumvent security restrictions and establish unauthorized connections.

The vulnerability of the Session Initiation Protocol SIP implementation and the Network Address Translation NAT function of the Application Layer Gateway ALG in microprogrammable network devices such as Cisco Adaptive Security Appliances ASA and Cisco Firepower Threat Defense FTD is related to...

Security update for barrier (moderate)

openSUSE Security Update: Security update for barrier Announcement ID: openSUSE-SU-2021:1498-1 Rating: moderate References: Cross-References: CVE-2021-42072 CVE-2021-42073 Affected Products: openSUSE Leap 15.2 An update that fixes two vulnerabilities is now available. Description: This update for...

Denial Of Service (DoS)

xen is vulnerable to denial of service. The vulnerability exists due to a address translation control structures page table shared between CPUs and confusion for the table's address into the hardward pagetable base register...

CVE-2021-28710

certain VT-d IOMMUs may not work in shared page table mode For efficiency reasons, address translation control structures page tables may and, on suitable hardware, by default will be shared between CPUs, for second-level translation EPT, and IOMMUs. These page tables are presently set up to alwa...

CVE-2021-28710

certain VT-d IOMMUs may not work in shared page table mode For efficiency reasons, address translation control structures page tables may and, on suitable hardware, by default will be shared between CPUs, for second-level translation EPT, and IOMMUs. These page tables are presently set up to alwa...