CVE-2021-3779

A malicious MySQL server can request local file content from a client using ruby-mysql prior to version 2.10.0 without explicit authorization from the user. This issue was resolved in version 2.10.0 and later...

google-oauth-client: Token signature not verified

A flaw was found in Google OAuth Java client's IDToken verifier, where it does not verify if the token is properly signed. This issue could allow an attacker to provide a compromised token with a custom payload that will pass the validation on the client side, allowing access to information outsi...

CVE-2022-31031 Potential stack buffer overflow when parsing message as a STUN client

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions prior to and including 2.12.1 a stack buffer overflow vulnerability affects PJSIP users that use STUN in their...

ai.h2o:sparkling-water-core_2.11 (>=3.32.0.1-2-2.1 <=3.36.0.2-1-2.4), ai.h2o:sparkling-water-doc_2.11 (>=3.34.0.3-1-2.2 <=3.36.0.2-1-2.4) +251 more potentially affected by CVE-2021-20218 via io.fabric8:kubernetes-client (>=4.2.0 <=4.7.1)

io.fabric8:kubernetes-client MAVEN version =4.2.0, =3.32.0.1-2-2.1, =3.34.0.3-1-2.2, =3.34.0.3-1-2.2, =3.34.0.3-1-2.2, =0.0.1, =1.9.51, =1.1.1, =7.4.1, =7.4.1play2.6, =23.1.0play2.7, =0.0.1, =0.0.1, =0.3.6, =0.2.0, =0.2.0, =0.3.9 and more Source cves: CVE-2021-20218 Source advisory: OSV:GHSA-JWH...

ai.h2o:sparkling-water-core_2.12 (>=3.32.1.2-1-3.1 <=3.36.0.2-1-3.1), ai.h2o:sparkling-water-doc_2.12 (>=3.34.0.3-1-3.1 <=3.36.0.2-1-3.1) +124 more potentially affected by CVE-2021-20218 via io.fabric8:kubernetes-client (>=4.12.0 <=4.13.1)

io.fabric8:kubernetes-client MAVEN version =4.12.0, =3.32.1.2-1-3.1, =3.34.0.3-1-3.1, =3.34.0.3-1-3.1, =3.34.0.3-1-3.1, =2.1.0, =2.7.0, =3.2.0, =2.17.1, =0.0.1, =0.0.12, =0.0.4, =0.0.3, =0.0.1, =1.0.2 and more Source cves: CVE-2021-20218 Source advisory: OSV:GHSA-JWH2-FFG4-48XC...

GHSA-JF99-2RJ4-JXRM Transifex command-line client has improper certificate validation

Transifex command-line client before 0.10 does not validate X.509 certificates for data transfer connections, which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2073...

The vulnerability of the AWS VPN Client service, related to the disclosure of information, allows a perpetrator to expose the protected information.

The vulnerability of the AWS VPN Client relates to the exposure of information. Exploiting this vulnerability could allow a malicious actor to disclose protected information using a specially created malicious configuration file named ovpn...

F5 BIG-IP APM 安全漏洞

F5 BIG-IP APM Edge Client for Windows is a client-side access control authentication access client application from F5. A security vulnerability exists in F5 BIG-IP APM Edge Client for Windows, which can be exploited by attackers to obtain privilege escalation on client Windows systems...

CVE-2022-21716 Buffer Overflow in Twisted

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach...

[SECURITY] [DLA 2919-1] python2.7 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2919-1 [email protected] https://www.debian.org/lts/security/ Anton Gladky February 12, 2022 https://wiki.debian.org/LTS -...

CVE-2021-36349

Dell EMC Data Protection Central versions 19.5 and prior contain a Server Side Request Forgery vulnerability in the DPC DNS client processing. A remote malicious user could potentially exploit this vulnerability, allowing port scanning of external hosts...

Security Bulletin: IBM UrbanCode Velocity CVE-2021-44228, Apache Log4j

Summary IBM UrbanCode Velocity is vulnerable to CVE-2021-44228, Apache Log4j in the web client. The other IBM UrbanCode Velocity services are built upon JavaScript which use Log4js and based on current knowledge and analysis, we believe are not affected. Vulnerability Details CVEID: CVE-2021-4422...

The vulnerability of the mail client in operating systems such as iOS, iPadOS, and watchOS allows a hacker to trigger a service failure.

The vulnerability of the email client in operating systems such as iOS, iPadOS, and watchOS is related to the operation of writing data beyond the buffer in memory when processing malicious email messages. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

CVE-2021-38665

Remote Desktop Protocol Client Information Disclosure Vulnerability...

MQTT 缓冲区错误漏洞

MQTT Message Queuing Telemetry Transport is a messaging protocol based on the Publish/Subscribe paradigm under the ISO standard ISO/IEC PRF 20922, which works on the TCP/IP protocol family and is designed as a publish/subscribe messaging protocol for remote devices with low hardware performance a...

Security Bulletin: FileNet Content Manager is affected by a HTTP Client vulnerability

Summary FileNet Content Manager has addressed the following HTTP Client v3.0.1 and v4.0.1 vulnerability. Vulnerability Details CVEID: CVE-2012-5783 DESCRIPTION: Apache Commons HttpClient, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, could allow a remote...

CVE-2021-31354

An Out Of Bounds OOB access vulnerability in the handling of responses by a Juniper Agile License JAL Client in Juniper Networks Junos OS and Junos OS Evolved, configured in Network Mode to use Juniper Agile License Manager may allow an attacker to cause a partial Denial of Service DoS, or lead t...

spotweb 跨站脚本漏洞

Spotweb is a Php-based Soptnet client that follows the Spotnet protocol from the Spotweb team. 1.5.1 and previous versions of Spotweb have a cross-site scripting vulnerability that can be exploited by attackers to execute JavaScript code on the client side...

SupportAssist Client 代码问题漏洞

Dell SupportAssist Client is a client application from Dell DELL, USA. The program provides automated, proactive and predictive techniques for troubleshooting, etc. Dell SupportAssist Client has a code issue vulnerability that can be exploited by attackers to load arbitrary .dll files using .dll...

golang: net/http: panic in ReadRequest and ReadResponse when reading a very large header

A vulnerability was detected in net/http of the Go standard library when parsing very large HTTP header values, causing a crash and subsequent denial of service. This vulnerability affects both clients and servers written in Go, however, servers are only vulnerable if the value of MaxHeaderBytes...