CVE-2021-33191

From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command ...

CVE-2021-33191

From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command ...

Command injection

From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command ...

CVE-2021-33191 MiNiFi CPP arbitrary script execution is possible on the agent's host machine through the c2 protocol

From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command ...

CVE-2021-33191

CVE-2021-33191 affects Apache NiFi MiNiFi C++ 0.5.0. The c2 protocol implements an agent-update command designed to patch the application binary, but an attacker could modify the c2-update path to execute an arbitrary command via the same privileges as the MiNiFi binary. This leads to potential a...

RLSA-2021:3253 Important: libsndfile security update

libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV. Security Fixes: libsndfile: Heap buffer overflow via crafted WAV file allows arbitrary code execution CVE-2021-3246 For more details about the security issues, including the impact, a CVSS...

Apache NiFi 操作系统命令注入漏洞

Apache NiFi is a data processing and distribution system from the Apache Foundation in the United States. The system is primarily used for data routing, transformation, and system mediation logic. versions prior to Apache NiFi MiNiFi C version 0.5.0 have security vulnerabilities that allow an...

Compilation database: An alternative way to configure your C or C++ analysis

Analyzing C or C++ code requires - in addition to the source code - the configuration that is used to build the code. At SonarSource, we have provided a tool to automate the extraction of this information, the build wrapper. This tool has been used successfully with many projects, yet there are...

CVE-2021-39599

Multiple Cross Site Scripting XSS vulnerabilities exists in CXUUCMS 3.1 in the search and c parameters in 1 public/search.php and in the 2 c parameter in admin.php...

BadAlloc Vulnerability Affecting BlackBerry QNX RTOS

Summary On August 17, 2021, BlackBerry publicly disclosed that its QNX Real Time Operating System RTOS is affected by a BadAlloc vulnerability—CVE-2021-22156. BadAlloc is a collection of vulnerabilities affecting multiple RTOSs and supporting libraries.1 A remote attacker could exploit...

GPAC Project on Advanced Content Integer Overflow Vulnerability (CNVD-2022-03631)

GPAC Project Advanced Content is an implementation of the MPEG-4 system standard, written in ANSI C. An integer overflow vulnerability exists in GPAC Project on Advanced Content, which stems from an unchecked algorithm and can be exploited by remote attackers to cause a heap buffer overflow,...

GPAC Project on Advanced Content Integer Overflow Vulnerability (CNVD-2022-03632)

GPAC Project Advanced Content is an implementation of the MPEG-4 system standard, written in ANSI C. An integer overflow vulnerability exists in GPAC Project on Advanced Content, which stems from an unchecked algorithm and can be exploited by remote attackers to cause a heap buffer overflow,...

CVE-2021-28636

Acrobat Reader DC versions 2021.005.20054 and earlier, 2020.004.30005 and earlier and 2017.011.30197 and earlier are affected by an Uncontrolled Search Path Element vulnerability. An attacker with access to the victim's C:/ folder could leverage this vulnerability to achieve arbitrary code...

openSUSE 15 Security Update : c-ares (openSUSE-SU-2021:1168-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1168-1 advisory. - To fix this vulnerability, update the affected packages: c-ares CVE-2021-3672 Note that Nessus has not tested for this issue but has instead relie...

openSUSE: Security Advisory for c-ares (openSUSE-SU-2021:1168-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2021:1168-1 Security update for c-ares

This update for c-ares fixes the following issues: Version update to git snapshot 1.17.1+20200724: - CVE-2021-3672: fixed missing input validation on hostnames returned by DNS servers bsc1188881 - If aresgetaddrinfo was terminated by an aresdestroy, it would cause crash - Crash in sortaddrinfo if...

Important: Red Hat Security Advisory: compat-exiv2-023 security update

An update for compat-exiv2-023 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

Important: Red Hat Security Advisory: exiv2 security update

An update for exiv2 is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

[SECURITY] Fedora 33 Update: mingw-c-ares-1.17.2-1.fc33

c-ares is a C library that performs DNS requests and name resolves asynchronously. c-ares is a fork of the library named 'ares', written by Greg Hudson at MIT...

[SECURITY] Fedora 34 Update: mingw-c-ares-1.17.2-1.fc34

c-ares is a C library that performs DNS requests and name resolves asynchronously. c-ares is a fork of the library named 'ares', written by Greg Hudson at MIT...