The vulnerability of the Xstream Java library for converting objects into XML or JSON formats stems from deficiencies in the deserialization mechanism. This allows attackers to gain access to protected information and replace objects on the server side.

The vulnerability of the Xstream Java library for converting objects into XML or JSON formats is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability can allow an attacker to gain access to protected information and replace objects on the server side by...

nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes

A regular expression denial of service ReDoS vulnerability was found in nodejs-ansi-regex. This could possibly cause an application using ansi-regex to use an excessive amount of CPU time when matching crafted ANSI escape codes...

jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until...

XStream: Unsafe deserizaliation of com.sun.org.apache.bcel.internal.util.ClassLoader

A flaw was found in xstream. A remote attacker may be able to execute arbitrary code only by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data

A flaw was found in Netty's netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service...

USN-5192-1 apache-log4j2 vulnerability

Chen Zhaojun discovered that Apache Log4j 2 allows remote attackers to run programs via a special crafted input. An attacker could use this vulnerability to cause a denial of service or possibly execute arbitrary code. Please see the following link for more information:...

The vulnerability of the TCP/IP protocol implementation in the Microsoft Windows operating system allows a perpetrator to cause a service failure.

The vulnerability of the TCP/IP protocol implementation in the Microsoft Windows operating system is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures by sending specially crafted input data to the application...

GHSA-J377-2X76-558H Improper Input Validation in is-email

is-email helps validate an email address. A ReDoS regular expression denial of service flaw was found in the Segment is-email package before 1.0.1 for Node.js. An attacker that is able to provide crafted input to the isEmailinput function may cause an application to consume an excessive amount of...

OESA-2021-1460 gmp security update

A GNU multiple precision arithmetic library. Security Fixes: GNU Multiple Precision Arithmetic Library GMP through 6.2.1 has an mpz/inpraw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.CVE-2021-43618...

MGASA-2021-0544 Updated gmp packages fix security vulnerability

Integer overflow in mpz/inpraw.c and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms...

Donglify 输入验证错误漏洞

Electronic Team Donglify is an application from Electronic Team, Inc. that shares Usb security keys over the Internet. an integer overflow vulnerability exists in Electronic Team Donglify, which can be exploited by attackers to execute arbitrary code in kernel mode or via specially crafted I/O...

Accops HyWorks DVM Tools 安全漏洞

Accops HyWorks is a suite of solutions consisting of software and hardware from Accops India. It is used to instantly and securely access enterprise applications remotely from anywhere, on any device and from any network. A buffer overflow vulnerability exists in Accops HyWorks DVM Tools, which c...

Nomachine NoMachine 输入验证错误漏洞

NoMachine is a remote desktop access tool from NoMachine Luxembourg. A security vulnerability exists in NoMachine Server, which can be exploited by an attacker to execute arbitrary code in kernel mode or cause a denial of service memory corruption and operating system crash via specially crafted...

Nomachine NoMachine 输入验证错误漏洞

NoMachine is a remote desktop access tool from NoMachine Luxembourg. A security vulnerability exists in NoMachine Enterprise Client, which can be exploited by a local attacker to cause a denial of service memory corruption and OS crash by executing arbitrary code in kernel mode or via specially...

FlexiHub 安全漏洞

FlexiHub is a way for the FlexiHub team to share and access remote devices. A security vulnerability exists in flexhub For Windows, which can be exploited by a local attacker to cause a denial of service memory corruption and operating system crash by executing arbitrary code in kernel mode or vi...

Amzetta Technologies Amzetta Zportal 输入验证错误漏洞

Amzetta Technologies Amzetta Zportal is a virtual desktop and application controller from Amzetta Technologies, Inc. It is used by administrators to create and manage hosted applications, virtual desktops, shared hosted desktops, and auditing services, provide resources for virtual desktops, prox...

Accops HyWorks输入验证错误漏洞

Accops HyWorks is a suite of solutions consisting of software and hardware from Accops India. It is used to instantly and securely access enterprise applications remotely from anywhere, on any device and from any network. An integer overflow vulnerability exists in the Accops HyWorks Windows...

CVE-2021-31632

b2evolution CMS v7.2.3 was discovered to contain a SQL injection vulnerability via the parameter cfqueryparam in the User login section. This vulnerability allows attackers to execute arbitrary code via a crafted input...

Debian DLA-2837-1 : gmp - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2837 advisory. - GNU Multiple Precision Arithmetic Library GMP through 6.2.1 has an mpz/inpraw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentatio...

Updated busybox packages fix security vulnerability

A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input. CVE-2021-42376 An attacker-controlled...