Design/Logic Flaw

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

UBUNTU-CVE-2019-15608

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

CVE-2019-15608

The CVE-2019-15608 issue is a TOCTOU race condition in Yarn where the package hash is computed before writing to the cache and not recomputed on read, enabling potential cache pollution. Connected sources confirm this affects Yarn versions older than 1.19.0 and that a fix exists in 1.19.0. Photon...

CVE-2019-15608

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

CVE-2019-15608

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

CVE-2019-15608: Time-of-check Time-of-use (TOCTOU) Race Condition

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

SilverStripe Priviledge escalation through cache pollution

In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution...

GHSA-6R58-4XGR-GM6M SilverStripe Priviledge escalation through cache pollution

In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution...

Node.js third-party modules: [yarn] yarn.lock integrity & hash check logic is broken

I would like to report a vulnerability in yarn. It allows to pollute yarn cache via a crafted yarn.lock file and place a malicious package into cache under any name/version, bypassing both integrity and hash checks in yarn.lock so that any future installs of that package will install the fake...

CVE-2019-12617

In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution...

CVE-2019-12617

In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution...

Design/Logic Flaw

In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution...

CVE-2019-12617

CVE-2019-12617 affects SilverStripe prior to or including version 4.3.3, with an access escalation vulnerability where CMS users with limited permissions can gain higher privileges due to a permission cache pollution issue. The connected records consistently describe “permission cache pollution” ...

CVE-2019-12617

In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution...

CVE-2019-12617: Undefined Security Weakness

In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution...

CVE-2019-12400

Affected software: Apache Santuario XML Security for Java 2.0.x (from 2.0.3) and all 2.1.x releases before 2.1.4. Root cause: a caching mechanism using a static pool of DocumentBuilders can cache a malicious thread-context class loader implementation registered by untrusted code, leading to reuse...

openSUSE Security Update : pdns (openSUSE-2019-989)

This update for pdns fixes the following issues : Security issues fixed : - CVE-2018-10851: Fixed denial of service via crafted zone record or crafted answer bsc1114157. - CVE-2018-14626: Fixed packet cache pollution via crafted query bsc1114169. %NASLMINLEVEL 70300 C Tenable Network Security, In...

Denial Of Service (DoS)

httpd is vulnerable to denial of service DoS attacks. The vulnerability exists as Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security...

Security update for pdns-recursor (moderate)

This update for pdns-recursor fixes the following issues: Security issues fixed: - CVE-2018-10851: Fixed denial of service via crafted zone record or crafted answer bsc1114157. - CVE-2018-14644: Fixed denial of service via crafted query for meta-types bsc1114170. - CVE-2018-14626: Fixed packet...

Security update for pdns (moderate)

This update for pdns fixes the following issues: Security issues fixed: - CVE-2018-10851: Fixed denial of service via crafted zone record or crafted answer bsc1114157. - CVE-2018-14626: Fixed packet cache pollution via crafted query bsc1114169. This update was imported from the...