Important: kernel

Issue Overview: AMD recommends using a software mitigation for this issue, which the kernel is enabling by default. The Linux kernel will use the generic retpoline software mitigation, instead of the specialized AMD one, on AMD instances 5a. This is done by default, and no administrator action is...

Exploit for Off-by-one Error in Sudo_Project Sudo

CVE-2021-3156 Sudo Baron Samedit This repository is CVE-202...

PT-2022-15009 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy affected versions not specified Description: The issue concerns Envoy, an open source edge and service proxy for cloud-native applications. It allows the re-use of TLS when certain certificate validation settings have changed from their...

Jenkins Pipeline 信息泄露漏洞

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.An information disclosure vulnerability exists in Jenkins Pipeline Build Step Plugin 2.15 and earlier versions, which stem...

xstream: Arbitrary code execution via unsafe deserialization of javax.swing.UIDefaults$ProxyLazyValue

A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality,...

Redash 安全漏洞

Redash is a data integration and analysis solution from the Israeli company Redash. The product supports data integration, data visualization, query editing, and data sharing.Redash 10.0.0 and earlier versions contain a security vulnerability that could be exploited by an attacker to spoof sessio...

Denial Of Service (DoS)

udisks2 is vulnerable to denial of service. The vulnerability exists because some user-accessible mount helpers use insecure defaults which allows an attacker to send a crafted image causing an application crash...

Apache Tomcat: Configuration Defaults

Configure the Apache Tomcat directory for policy compliance tests. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Unsafe defaults in `remark-html`

Impact The documentation of remark-html has mentioned that it was safe by default. In practise the default was never safe and had to be opted into. This means arbitrary HTML can be passed through leading to potential XSS attacks. Patches The problem has been patched in 13.0.2 and 14.0.1:...

CVE-2021-39199 Cross site scripting via unsafe defaults in remark-html

remark-html is an open source nodejs library which compiles Markdown to HTML. In affected versions the documentation of remark-html has mentioned that it was safe by default. In practice the default was never safe and had to be opted into. That is, user input was not sanitized. This means arbitra...

GHSA-34P9-F4Q3-C4R7 Improper Certificate Validation in openssl

All versions of rust-openssl prior to 0.9.0 contained numerous insecure defaults including off-by-default certificate verification and no API to perform hostname verification. Unless configured correctly by a developer, these defaults could allow an attacker to perform man-in-the-middle attacks...

Improper Certificate Validation in openssl

All versions of rust-openssl prior to 0.9.0 contained numerous insecure defaults including off-by-default certificate verification and no API to perform hostname verification. Unless configured correctly by a developer, these defaults could allow an attacker to perform man-in-the-middle attacks...

The vulnerability of the user management utilities useradd and adduser in the operating system “OSnova” lies in the use of insecure default settings, which allow attackers to gain access to protected information.

The vulnerability of the user management utilities useradd and adduser in the operating system is related to the use of insecure default settings. Exploiting this vulnerability can allow an attacker to gain access to protected information...

CVE-2021-36804

Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e-mail address. This issue was fixed in version 2.1.13 of the product. Please...

Unspecified vulnerability in DEPSTECH WiFi Digital Microscope

DEPSTECH WiFi Digital Microscope is a wifi industrial endoscope from Shenzhen Shenhai Innovation Technology Co., Ltd. in China. DEPSTECH WiFi Digital Microscope 3 has a security vulnerability that allows remote attackers to change the SSID and password and demand a ransom from the legitimate devi...

CVE-2021-25944

Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution...

CVE-2021-25944

Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution...

CVE-2021-25944

Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution...

Remote code execution

Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution...

CVE-2021-25944

Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution...