libuv: buffer overflow in realpath

A flaw has been found in libuv. The realpath implementation performs an incorrect calculation when allocating a buffer, leading to a potential buffer overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

CVE-2021-20235

There's a flaw in the zeromq server in src/decoderallocators.hpp. The decoder static allocator could have its sized changed, but the buffer would remain the same as it is a static buffer. A remote, unauthenticated attacker who sends a crafted request to the zeromq server could trigger a buffer...

CVE-2021-20188

A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the...

UBUNTU-CVE-2021-20188

A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the...

nodejs: HTTP request smuggling via two copies of a header field in an http request

A flaw was found in nodejs. Affected versions of Node.js allow two copies of a header field in an HTTP request. The first header field is recognized while the second is ignored leading to HTTP request smuggling. The highest threat from this vulnerability is to data confidentiality and integrity...

The vulnerability of the Miscellaneous component of the Oracle Scripting software for creating and processing scripts allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Miscellaneous component of the Oracle Scripting environment exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information through HTTP requests...

The vulnerability of the vAnalytics function in the programmatically defined Cisco SD-WAN network allows a attacker to compromise data integrity.

The vulnerability of the vAnalytics function in the programmatically defined Cisco SD-WAN network is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to compromise data integrity from a remote location...

The vulnerability of the Cisco Data Center Network Manager system, related to errors in the certificate validation process, allows a perpetrator to compromise the integrity of data.

The vulnerability of the Cisco Data Center Network Manager system is related to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker to compromise the integrity of data...

The vulnerability in the vManage web interface of the software-defined Cisco SD-WAN network allows a attacker to compromise the integrity of protected information.

The vulnerability in the vManage web interface of the Cisco SD-WAN software-defined network is related to errors in handling HTTP requests. Exploiting this vulnerability allows a malicious actor to compromise the integrity of protected information...

The vulnerability of the command-line interface (CLI) of the programmatically defined Cisco SD-WAN network allows a attacker to compromise the confidentiality and integrity of the protected information.

The vulnerability of the command-line interface CLI of Cisco SD-WAN software-defined networks is related to insufficient validation of input data. Exploiting this vulnerability can allow attackers to compromise the confidentiality and integrity of the protected information...

The vulnerability of the device controller in the Cisco Data Center Network Manager system allows a intruder to compromise the integrity of data.

The vulnerability of the Data Center Network Manager DCNM of the Cisco Data Center Network system is related to errors in the authentication process. Exploiting this vulnerability could allow an attacker to compromise the integrity of data...

CVE-2020-12395

Memory safety flaws were found in Mozilla Firefox and Thunderbird. Memory corruption that an attacker could leverage with enough effort, could allow arbitrary code to run. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

PT-2021-6549 · Faad2 +4 · Faad2 +4

Name of the Vulnerable Software and Affected Versions: faad2 versions prior to 2.10.0 Description: A heap-buffer-overflow issue exists in the stszin function located in mp4read.c, allowing an attacker to cause code execution. This issue can be exploited by a remote attacker to access confidential...

CVE-2021-20226

A use-after-free flaw was found in the iouring in Linux kernel, where a local attacker with a user privilege could cause a denial of service problem on the system. The issue results from the lack of validating the existence of an object prior to performing operations on the object by not...

Huawei EulerOS: Security Advisory for xorg-x11-server (EulerOS-SA-2021-1260)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP9 : dnsmasq (EulerOS-SA-2021-1244)

According to the versions of the dnsmasq package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with...

Huawei EulerOS: Security Advisory for dpdk (EulerOS-SA-2021-1241)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

nodejs: HTTP request smuggling via two copies of a header field in an http request

A flaw was found in nodejs. Affected versions of Node.js allow two copies of a header field in an HTTP request. The first header field is recognized while the second is ignored leading to HTTP request smuggling. The highest threat from this vulnerability is to data confidentiality and integrity...

CVE-2020-9492

A flaw was found in Apache hadoop. The WebHDFS client can send a SPNEGO authorization header to a remote URL without proper verification which could lead to an access restriction bypass. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

CVE-2021-21610

A flaw was found in jenkins. A cross-site scripting XSS vulnerability is possible due to the lack of restrictions in URL rendering in the formatted previews of markup passed as a query parameter if the configured markup formatter does not prohibit unsafe elements in the markup. The highest threat...