The vulnerability of the programmatically defined Cisco SD-WAN network, related to the execution of operations outside the buffer in memory, allows a attacker to compromise the confidentiality and integrity of the protected information.

The vulnerability of the programmatically defined Cisco SD-WAN network is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and integrity of the protected information...

CVE-2020-6581

A flaw was found in nrpe. A command injection is possible due to insufficient filtering. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Mitigation Disable nastymetachars and dontblamenrpe option inside the NRPE configuration fil...

PT-2020-5771 · Renaud Dubois Christophe Wolfhugel Olivier Salauen +2 · Sympa +2

Name of the Vulnerable Software and Affected Versions: Sympa versions prior to 6.2.56 Description: The issue is related to a lack of privilege management mechanism in the Sympa mailing list manager, which can be exploited to gain access to confidential data, compromise data integrity, and cause a...

CVE-2020-9546

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

CVE-2020-1744

A flaw was found in keycloak. BruteForceProtector does not handle Conditional OTP Authentication Flow login failure events due to these events not being sent to the brute force protection event queue. The highest threat from this vulnerability is to data confidentiality and integrity as well as...

netty: HTTP request smuggling

A HTTP smuggling flaw was found in HttpObjectDecoder.java in Netty in versions prior to version 4.1.44. HTTP headers with an invalid fold, in this case CRLF carriage return, line feed without being followed by SP space or HTAB horizontal tab, result in situations where headers can be misread. Dat...

PT-2020-3648 · Apache · Apache Traffic Server

Name of the Vulnerable Software and Affected Versions: Apache Traffic Server versions 6.0.0 through 6.2.3 Apache Traffic Server versions 7.0.0 through 7.1.8 Apache Traffic Server versions 8.0.0 through 8.0.5 Description: The issue is related to inconsistent interpretation of HTTP requests, which...

Security Breach Disrupts Fintech Firm Finastra

Finastra, a company that provides a range of technology solutions to banks worldwide, said today it was shutting down key systems in response to a security breach discovered this morning. The company's public statement and notice to customers does not mention the cause of the outage, but their...

PT-2020-2103

Name of the Vulnerable Software and Affected Versions Mozilla Bleach versions prior to 3.12 Description A mutation XSS issue affects users calling bleach.clean with specific settings, including whitelisting svg or math tags, allowing RCDATA tags, and setting the strip keyword argument to False...

zsh: insecure dropping of privileges when unsetting PRIVILEGED option

A flaw was found in zsh. When unsetting the PRIVILEGED option, the shell sets its effective user and group IDs to match their respective real IDs. When the RUID and EUID were both non-zero, it is possible to regain the shell's former privileges. Also, the setopt built-in did not correctly report...

Dell Data Protection Centra Trust Management Issues Vulnerability

Dell Data Protection Central is a suite of data protection solutions from Dell USA. The product provides single sign-on, dashboards, and system monitoring. A trust management issue vulnerability exists in Dell Data Protection Central. A remote attacker could exploit this vulnerability by obtainin...

PT-2021-13830 · Podman +5 · Podman +5

Name of the Vulnerable Software and Affected Versions: podman versions prior to 1.7.0 Description: A flaw was found in podman where file permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the containe...

CVE-2019-3762

Data Protection Central versions 1.0, 1.0.1, 18.1, 18.2, and 19.1 contains an Improper Certificate Chain of Trust Vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by obtaining a CA signed certificate from Data Protection Central to impersonate a valid...

Input validation

Data Protection Central versions 1.0, 1.0.1, 18.1, 18.2, and 19.1 contains an Improper Certificate Chain of Trust Vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by obtaining a CA signed certificate from Data Protection Central to impersonate a valid...

The vulnerability of the urllib2 module in the Python programming language allows attackers to compromise the confidentiality and integrity of protected information.

The vulnerability of the urllib2 module in the Python programming language exists due to the failure to address the issue of handling CRLF sequences. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality and integrity of protected information by introducing...

tomcat: Session fixation when using FORM authentication

It was found that tomcat's FORM authentication allowed a very small period in which an attacker could possibly force a victim to use a valid user session, or Session Fixation. While practical exploit of this issue is deemed highly improbable, an abundance of caution merits it be considered a flaw...

The vulnerability of the BeanIntrospector class in the Apache Commons Beanutils utility allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the BeanIntrospector class in the Apache Commons Beanutils utility is related to the reallocation of memory for unreliable data structures. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

The vulnerability of the mod_rewrite function in the Apache HTTP Server allows attackers to gain unauthorized access to confidential information or compromise the integrity of that information.

The vulnerability of the modrewrite function in the Apache HTTP Server relates to the redirection of URLs to an unreliable website. Exploiting this vulnerability can allow attackers to gain unauthorized access to confidential information or affect the integrity of that information through special...

netty: HTTP request smuggling

A HTTP smuggling flaw was found in HttpObjectDecoder.java in Netty in versions prior to version 4.1.44. HTTP headers with an invalid fold, in this case CRLF carriage return, line feed without being followed by SP space or HTAB horizontal tab, result in situations where headers can be misread. Dat...

netty: HTTP request smuggling

A HTTP smuggling flaw was found in HttpObjectDecoder.java in Netty in versions prior to version 4.1.44. HTTP headers with an invalid fold, in this case CRLF carriage return, line feed without being followed by SP space or HTAB horizontal tab, result in situations where headers can be misread. Dat...