IRQ vector leak on x86

ISSUE DESCRIPTION An x86 HVM guest with PCI pass through devices can force the allocation of all IDT vectors on the system by rebooting itself with MSI or MSI-X capabilities enabled and entries setup. Such reboots will leak any vectors used by the MSI-X entries that the guest might had enabled, a...

CVE-2021-1312

A vulnerability in the system resource management of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to cause a denial of service DoS to the health monitor API on an affected device. The vulnerability is due to inadequate provisioning of kernel parameters for...

Design/Logic Flaw

A vulnerability in the system resource management of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to cause a denial of service DoS to the health monitor API on an affected device. The vulnerability is due to inadequate provisioning of kernel parameters for...

Debian DLA-2525-1 : wavpack security update

Multiple vulnerabilites in wavpack were found, like OOB read which could potentially lead to a DOS attack, unexpected control flow, crashes, integer overflow, and segfaults. For Debian 9 stretch, these problems have been fixed in version 5.0.0-2+deb9u3. We recommend that you upgrade your wavpack...

CVE-2021-3181

rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service mailbox unavailability by sending email messages with sequences of semicolon characters in RFC822 address fields aka terminators of empty groups. A small email message from the attacker can cause large memory...

Debian: Security Advisory (DLA-2525-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2525-1] wavpack security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2525-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta January 15, 2021 https://wiki.debian.org/LTS -...

CVE-2019-3405

In the 3.1.3.64296 and lower version of 360F5, the third party can trigger the device to send a deauth frame by constructing and sending a specific illegal 802.11 Null Data Frame, which will cause other wireless terminals connected to disconnect from the wireless, so as to attack the router...

CVE-2019-3405

In the 3.1.3.64296 and lower version of 360F5, the third party can trigger the device to send a deauth frame by constructing and sending a specific illegal 802.11 Null Data Frame, which will cause other wireless terminals connected to disconnect from the wireless, so as to attack the router...

DoS by uploading a lot of data for avatars in Confluence - CVE-2020-29450

Affected versions of Atlassian Confluence Server allow remote attackers to impact the application's availability via a Denial of Service DoS vulnerability in the avatar upload feature in Confluence. The affected versions are before version 7.2.0. Affected versions: version 7.2.0 Fixed versions:...

DoS by uploading a lot of data for avatars in Confluence - CVE-2020-29450

Affected versions of Atlassian Confluence Server allow remote attackers to impact the application's availability via a Denial of Service DoS vulnerability in the avatar upload feature in Confluence. The affected versions are before version 7.2.0. Affected versions: version 7.2.0 Fixed versions:...

EulerOS Virtualization for ARM 64 3.0.2.0 : trousers (EulerOS-SA-2021-1051)

According to the versions of the trousers package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by...

CVE-2019-15080

An issue was discovered in a smart contract implementation for MORPH Token through 2019-06-05, an Ethereum token. A typo in the constructor of the Owned contract which is inherited by MORPH Token allows attackers to acquire contract ownership. A new owner can subsequently obtain MORPH Tokens for...

CVE-2019-15080

An issue was discovered in a smart contract implementation for MORPH Token through 2019-06-05, an Ethereum token. A typo in the constructor of the Owned contract which is inherited by MORPH Token allows attackers to acquire contract ownership. A new owner can subsequently obtain MORPH Tokens for...

Code injection

An issue was discovered in a smart contract implementation for MORPH Token through 2019-06-05, an Ethereum token. A typo in the constructor of the Owned contract which is inherited by MORPH Token allows attackers to acquire contract ownership. A new owner can subsequently obtain MORPH Tokens for...

CVE-2019-15080

An issue was discovered in a smart contract implementation for MORPH Token through 2019-06-05, an Ethereum token. A typo in the constructor of the Owned contract which is inherited by MORPH Token allows attackers to acquire contract ownership. A new owner can subsequently obtain MORPH Tokens for...

CVE-2019-15080

The CVE describes a vulnerability in MORPH Token (Ethereum) where a typo in the constructor of the Owned contract, inherited by MORPH Token, allows an attacker to acquire contract ownership. This new owner can obtain MORPH Tokens for free and can trigger a DoS attack. Details are limited to the d...

Denial Of Service (DoS)

libnested is vulnerable to denial of service. An attacker is able to exploit the vulnerability to inject arbitrary properties into existing construct prototypes and modify attributes such as proto, constructor and prototype causing a denial of service and may lead to remote code execution...

Command injection

In S+ Operations and S+ Historian, not all client commands correctly check user permission as expected. Authenticated but Unauthorized remote users could execute a Denial-of-Service DoS attack, execute arbitrary code, or obtain more privilege than intended on the machines...

CVE-2020-24674

CVE-2020-24674 affects S+ Operations and S+ Historian. The issue is improper authorization where not all client commands properly enforce user permissions. Authenticated but Unauthorized remote users could trigger a Denial-of-Service, execute arbitrary code, or gain higher privileges on affected ...