jetty: SessionListener can prevent a session from being invalidated breaking logout

A flaw was discovered in the jetty-server, where if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts, this could result in a session not being...

Denial Of Service (DoS)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Roles. Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...

SAP NetWeaver AS 安全漏洞

SAP NetWeaver AS is a SAP network application server from SAP. It not only provides network services, but is also the basic platform for SAP software. SAP NetWeaver AS ABAP and ABAP Platform versions 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756 have a security vulnerabilit...

CVE-2021-42013

A path traversal and remote code execution flaw was found in Apache HTTP Server 2.4.49 and 2.4.50. A remote attacker could use this flaw to map URLs to files outside the expected document root. Additionally, this flaw could leak the source of interpreted files like CGI scripts. If files outside o...

samba: Negative idmap cache entries can cause incorrect group entries in the Samba file server process token

A flaw was found in samba. The Samba smbd file server must map Windows group identities SIDs into unix group ids gids. The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache...

The vulnerability of the XMPP Dino chat client, related to deficiencies in path name limitation, allows attackers to compromise data integrity.

The vulnerability of the XMPP Dino chat client is related to a bug in URI-encoded path separators. Exploiting this vulnerability could allow an attacker to compromise data integrity remotely...

The vulnerability of the Eterm, Mrxyt, Rxyt-unicode software lies in their SSL-Proxy function, which allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Eterm, Mrxyt, Rxyt, and Rxyt-unicode software lies in the improper handling of certain control sequences. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of software for performing virtualization at the operating system level, also known as containerization, Singularity, arises from insufficient checking of unusual or exceptional states. This allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of software for performing virtualization at the operating system level, also known as containerization, is related to improper checking of the return value of functions. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data, compromise it...

The vulnerability of the Double Ratchet Libolm cryptographic ratchet implementation lies in the possibility of data being written beyond the buffer boundaries. This allows attackers to gain access to confidential data, compromise its integrity, and even cause service failures.

The vulnerability of the Double Ratchet Libolm cryptographic ratchet implementation lies in the writing beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker operating remotely to gain access to confidential data, compromise its integrity, and even cause service...

The vulnerability of CKEditor’s WYSIWYG editor, related to the lack of measures taken to protect the structure of web pages, allows attackers to compromise data integrity.

The vulnerability of the CKEditor WYSIWYG editor is related to the incorrect processing of the “--!” comment. Exploiting this vulnerability may allow an attacker to compromise the integrity of the data...

The vulnerability of the authentication method for the SOGo collaborative work system, which stems from incorrect verification of the cryptographic signature of data, allows attackers to compromise the integrity of the data.

The vulnerability of the SOGo collaborative computing software’s authentication method is related to improper verification of the data’s cryptographic signature. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the data...

The vulnerability of the ext4_writeinline_data_end function (fs/ext4/inline.c) in the Linux kernel allows a attacker to compromise the integrity, accessibility, and confidentiality of data.

The vulnerability of the ext4writeinlinedataend function fs/ext4/inline.c in the Linux kernel arises from the simultaneous execution using shared resources with incorrect synchronization in the “race condition” scenario. Exploiting this vulnerability can allow an attacker to compromise the...

The vulnerability of Mermaid software for generating diagrams and block diagrams lies in the lack of measures taken to protect the structure of web pages, allowing attackers to compromise data integrity.

The vulnerability of Mermaid software for generating diagrams and block diagrams is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow a remote attacker to compromise the integrity of data...

The vulnerability of the web framework for creating APIs using the Python FastAPI language relates to the manipulation of cross-site requests. This vulnerability allows attackers to gain access to sensitive data and compromise its integrity.

The vulnerability of the web framework for creating APIs using the Python FastAPI language is related to an error in cookies for authentication purposes. During path operations, useful JSON payloads were received. Exploiting this vulnerability could allow a remote attacker to gain access to...

The vulnerability in the kernel/bpf/hashtab.c component of the Linux operating system, related to writing beyond buffer boundaries in memory, allows an attacker to compromise the integrity, accessibility, and confidentiality of data.

The vulnerability in the kernel/bpf/hashtab.c component of the Linux operating system is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to compromise the integrity, accessibility, and confidentiality of data...

The vulnerability of the Singularity container platform, related to the failure to cleanse input data, allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Singularity container platform relates to the failure to cleanse input data. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its integrity, and cause service failures...

Security Bulletin: IBM Event Streams is affected by potential data integrity issue (CVE-2020-25649)

Summary IBM Event Streams is potentially vulnerable to a data integrity issue Vulnerability Details CVEID: CVE-2020-25649 DESCRIPTION: FasterXML Jackson Databind could provide weaker than expected security, caused by not having entity expansion secured properly. A remote attacker could exploit th...

ntfs-3g: Out-of-bounds access in ntfs_decompress()

The ntfs3g package is susceptible to a heap overflow on crafted input. When processing an NTFS image, proper bounds checking was not enforced leading to this software flaw. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability...

The vulnerability of the real-time operating system Zephyr’s memory allocation function allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of Zephyr’s real-time operating system’s memory allocation function is caused by a numerical overflow. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information...

CVE-2021-3521

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature."1 RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey t...