NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the stbiconvertformat function via the stbimage.h component. An attacker can cause a crash and denial of service by loading a specially crafted invalid PICT file. Remediation A fix was pushed into the master...

Updated log4j packages fix security vulnerability

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map MDC input data when the logging configuration uses a non-default Pattern Layout with either a Context...

CVE-2021-41500

CVE-2021-41500 is an incomplete string comparison vulnerability in the cvxopt.org cvxop API surface (versions

Design/Logic Flaw

Out-of-bounds Read vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior, Mitsubishi Electric MELSOFT Navigator versions 2.84N and prior and Mitsubishi Electric EZSocket versions 5.4 and prior allows an attacker to cause a DoS condition in the software by getting a user to open...

Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat

Description I found one more CSRF at Clean cache in the System tab of System configuration via GET request. Proof of Concept CLICK ME! Impact This vulnerability is capable of tricking admin to clear the cache of the system, that can potential lead to a DoS attack. Remediation Use POST request...

[SECURITY] [DSA 5022-1] apache-log4j2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5022-1 [email protected] https://www.debian.org/security/ Markus Koschany December 16, 2021 https://www.debian.org/security/faq -...

CVE-2021-1038

In UserDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11...

CVE-2021-43801

Mercurius is a GraphQL adapter for Fastify. Any users from [email protected] to 8.11.1 are subjected to a denial of service attack by sending a malformed JSON to /graphql unless they are using a custom error handler. The vulnerability has been fixed in...

CVE-2021-39933

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression used for handling user input notes, comments, etc was susceptible to catastroph...

CVE-2021-39917

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression related to quick actions features was susceptible to catastrophic backtracking...

CVE-2021-39917

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression related to quick actions features was susceptible to catastrophic backtracking...

Code injection

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression used for handling user input notes, comments, etc was susceptible to catastroph...

Design/Logic Flaw

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression related to quick actions features was susceptible to catastrophic backtracking...

CVE-2021-39933

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression used for handling user input notes, comments, etc was susceptible to catastroph...

CVE-2021-39917

CVE-2021-39917 affects GitLab CE/EE: a regular expression used by quick actions is vulnerable to catastrophic backtracking, enabling a DOS. Impacted: GitLab versions 12.9–14.3.5, 14.4.0–14.4.3, and 14.5.0–14.5.1. Remediation: upgrade to fixed releases (14.3.6, 14.4.4, or 14.5.2 or newer as applic...

CVE-2021-39917

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression related to quick actions features was susceptible to catastrophic backtracking...

CVE-2021-39933

CVE-2021-39933 affects GitLab CE/EE: all versions starting from 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, and all versions starting from 14.5 before 14.5.2. An input handling regex (notes, comments, etc) is vulnerable to catastrophic backtracking, enabling a denial of se...

CVE-2021-39933

Removed by vendor...

CVE-2021-41450

An HTTP request smuggling attack in TP-Link AX10v1 before v1211117 allows a remote unauthenticated attacker to DoS the web application via sending a specific HTTP packet...

Design/Logic Flaw

An HTTP request smuggling attack in TP-Link AX10v1 before v1211117 allows a remote unauthenticated attacker to DoS the web application via sending a specific HTTP packet...