Huawei Emui and Magic UI Memory Out-of-Bounds Access Vulnerability

Huawei Emui is a mobile operating system developed based on Android.Magic Ui is a mobile operating system developed based on Android. A memory out-of-bounds access vulnerability exists in Huawei Emui and Magic UI. The vulnerability exists due to a boundary error when handling untrusted input. An...

HarmonyOS Out-of-Bounds Read Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. HarmonyOS prior to version 2.0 suffers from an out-of-bounds read vulnerability, which originates from a boundary error in a component of HarmonyOS that...

Huawei Emui and Magic UI Buffer Overflow Vulnerability

Huawei Emui is a mobile operating system developed based on Android.Magic Ui is a mobile operating system developed based on Android. A buffer overflow vulnerability exists in Huawei Emui and Magic UI due to a boundary error when handling untrusted input. An attacker can exploit this vulnerabilit...

Chromium: CVE-2021-38000 Insufficient validation of untrusted input in Intents

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information. Google is aware that exploits for this vulnerability exist in the wild...

Microsoft Edge (Chromium) < 95.0.1020.40 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 95.0.1020.40. It is, therefore, affected by multiple vulnerabilities as referenced in the October 29, 2021 advisory. - Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker...

Huawei HarmonyOS 安全漏洞

Huawei Emui is a mobile operating system developed based on Android.Magic Ui is a mobile operating system developed based on Android. A buffer overflow vulnerability exists in Huawei Emui and Magic UI due to a boundary error when handling untrusted input. An attacker can exploit this vulnerabilit...

Huawei HarmonyOS 缓冲区错误漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. HarmonyOS prior to version 2.0 suffers from an out-of-bounds read vulnerability, which originates from a boundary error in a component of HarmonyOS that...

Google Chrome < 95.0.4638.69 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 95.0.4638.69. It is, therefore, affected by multiple vulnerabilities as referenced in the 202110stable-channel-update-for-desktop28 advisory. - Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69...

DEBIAN-CVE-2021-41182

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now...

UBUNTU-CVE-2021-41182

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now...

UBUNTU-CVE-2021-41183

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various Text options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various Text options are now alway...

Google Chrome 输入验证错误漏洞

Chrome is a web browsing tool developed by Google, and an insufficient validation of untrusted input vulnerability exists in Downloads in versions prior to Google Chrome 95.0.4638.54. An attacker could exploit this vulnerability to bypass navigation restrictions via malicious files...

CVE-2021-42388

Heap out-of-bounds read in ClickHouse’s LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl loop, a 16-bit unsigned user-supplied value ‘offset’ is read from the compressed data. The offset is later used in the length of a copy operation, without checking the...

libxml2: Use after free via namespace node in XPointer ranges

A use-after-free flaw was found in the Xpointer implementation of libxml2. An attacker could use this flaw against an application parsing untrusted XML files and compiled with libxml2 to leak small amount of memory data...

CVE-2021-41720

Removed by vendor...

XML External Entity (XXE) Injection

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to XML External Entity XXE Injection. Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected: - Nokogiri::XML::SAX::Parse -...

GHSA-5VCM-3XC3-W7X3 Response Splitting from unsanitized headers

Impact http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names Header.nameå Header values Header.value Status reason phrases Status.reason URI paths Uri.Path URI authority registered names...

GHSA-XPFP-F569-Q3P2 SQL Injection in Django

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application...

CVE-2021-41084

http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names Header.nameå, Header values Header.value, Status reason phrases...

OESA-2021-1335 jsoup security update

jsoup is a Java library for working with real-world HTML. It provides a very convenient API for extracting and manipulating data, using the best of DOM, CSS, and jquery-like methods. Security Fixes: jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse...