[SECURITY] [DSA 5022-1] apache-log4j2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5022-1 [email protected] https://www.debian.org/security/ Markus Koschany December 16, 2021 https://www.debian.org/security/faq -...

CVE-2021-1038

In UserDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11...

CVE-2021-43801

Mercurius is a GraphQL adapter for Fastify. Any users from [email protected] to 8.11.1 are subjected to a denial of service attack by sending a malformed JSON to /graphql unless they are using a custom error handler. The vulnerability has been fixed in...

CVE-2021-39933

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression used for handling user input notes, comments, etc was susceptible to catastroph...

CVE-2021-39917

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression related to quick actions features was susceptible to catastrophic backtracking...

CVE-2021-39933

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression used for handling user input notes, comments, etc was susceptible to catastroph...

Code injection

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression used for handling user input notes, comments, etc was susceptible to catastroph...

Design/Logic Flaw

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression related to quick actions features was susceptible to catastrophic backtracking...

CVE-2021-39917

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression related to quick actions features was susceptible to catastrophic backtracking...

CVE-2021-39917

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression related to quick actions features was susceptible to catastrophic backtracking...

CVE-2021-39917

CVE-2021-39917 affects GitLab CE/EE: a regular expression used by quick actions is vulnerable to catastrophic backtracking, enabling a DOS. Impacted: GitLab versions 12.9–14.3.5, 14.4.0–14.4.3, and 14.5.0–14.5.1. Remediation: upgrade to fixed releases (14.3.6, 14.4.4, or 14.5.2 or newer as applic...

CVE-2021-39933

CVE-2021-39933 affects GitLab CE/EE: all versions starting from 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, and all versions starting from 14.5 before 14.5.2. An input handling regex (notes, comments, etc) is vulnerable to catastrophic backtracking, enabling a denial of se...

CVE-2021-39933

Removed by vendor...

CVE-2021-41450

An HTTP request smuggling attack in TP-Link AX10v1 before v1211117 allows a remote unauthenticated attacker to DoS the web application via sending a specific HTTP packet...

Design/Logic Flaw

An HTTP request smuggling attack in TP-Link AX10v1 before v1211117 allows a remote unauthenticated attacker to DoS the web application via sending a specific HTTP packet...

Denial Of Service

@next/mdx is vulnerable to denial of service. The vulnerability exists due to lack of sanitation of URL in 'next-server.ts', allowing an attacker to crash the server using invalid or malformed URL...

CVE-2021-44527

CVE-2021-44527 affects UniFi Switch firmware versions 5.43.35 and earlier, enabling a network-armed attacker who already has access to trigger a Denial of Service on the affected switch. The issue is resolved in UniFi Switch firmware 5.76.6 and later. The available documents describe the vulnerab...

CVE-2021-44527

A vulnerability found in UniFi Switch firmware Version 5.43.35 and earlier allows a malicious actor who has already gained access to the network to perform a Deny of Service DoS attack on the affected switch.This vulnerability is fixed in UniFi Switch firmware 5.76.6 and later...

CLSA-2021-1638803748 Fix of CVE: CVE-2021-27212

CVE-2021-27212: fix DoS via malicious packet...

issues with partially successful P2M updates on x86

ISSUE DESCRIPTION x86 HVM and PVH guests may be started in populate-on-demand PoD mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specifie...