CVE-2021-23007

On BIG-IP versions 14.1.4 and 16.0.1.1, when the Traffic Management Microkernel TMM process handles certain undisclosed traffic, it may start dropping all fragmented IP traffic. Note: Software versions which have reached End of Software Development EoSD are not evaluated...

Citrix Hypervisor Security Update

Description of Problem Two security issues have been identified in Citrix Hypervisor formerly Citrix XenServer that may allow privileged code in a guest VM to cause the host to crash or become unresponsive. These issues affect all currently supported versions of Citrix Hypervisor up to and...

F5 BIG-IP security vulnerabilities

F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, load balancing, and other functions from F5 Corporation. A security vulnerability exists in the F5 BIG-IP TMM Fragmented IP Traffic Drop, which can be exploited by an attacke...

RUSTSEC-2021-0053 'merge_sort::merge()' crashes with double-free for `T: Drop`

In the affected versions of this crate, mergesort::merge wildly duplicates and drops ownership of T without guarding against double-free. Due to such implementation, simply invoking mergesort::merge on Vec can cause double free bugs...

'merge_sort::merge()' crashes with double-free for `T: Drop`

In the affected versions of this crate, mergesort::merge wildly duplicates and drops ownership of T without guarding against double-free. Due to such implementation, simply invoking mergesort::merge on Vec can cause double free bugs...

PT-2021-19620

Name of the Vulnerable Software and Affected Versions: algorithmica crate through 2021-03-07 Description: The issue is related to a double free in the merge sort::merge function. In the affected versions of the algorithmica crate, merge sort::merge duplicates and drops ownership of T without...

CVE-2021-28035

An issue was discovered in the stackdst crate before 0.6.1 for Rust. Because of the pushinner behavior, a drop of uninitialized memory can occur upon a val.clone panic...

CVE-2021-28035

CVE-2021-28035 affects the Rust crate stack_dst, prior to 0.6.1. The root cause is the push_inner behavior, which can cause a drop of uninitialized memory if a val.clone() panics. The issue has been fixed in a later commit (and by upgrading to 0.6.1+). If exploited, this can lead to memory safety...

CVE-2021-28033

The CVE-2021-28033 issue concerns the byte_struct crate for Rust pre-0.6.1, where deserializing via a certain method could cause a drop of uninitialized memory when panicking. Affected component: byte_struct (Rust) before 0.6.1. Impact described as potential memory safety failure during deseriali...

CVE-2021-28033

An issue was discovered in the bytestruct crate before 0.6.1 for Rust. There can be a drop of uninitialized memory if a certain deserialization method panics...

CVE-2021-28035: Use of Uninitialized Resource

An issue was discovered in the stackdst crate before 0.6.1 for Rust. Because of the pushinner behavior, a drop of uninitialized memory can occur upon a val.clone panic...

OPENSUSE-SU-2021:0370-1 Security update for avahi

This update for avahi fixes the following issues: - CVE-2021-26720: drop privileges when invoking avahi-daemon-check-dns.sh bsc1180827 - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Add sudo to requires: used to drop privileges. This...

CVE-2021-27888

ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters...

CVE-2021-27888

ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters...

CVE-2021-27888

ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters...

PT-2021-17647

Name of the Vulnerable Software and Affected Versions: ZendTo versions prior to 6.06-4 Beta Description: The issue allows for XSS during the display of a drop-off in which a filename has unexpected characters. Recommendations: For versions prior to 6.06-4 Beta, update to version 6.06-4 Beta or...

CVE-2021-27888: Improper Neutralization of Input During Web Page Generation

ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters...

PT-2021-17721

Name of the Vulnerable Software and Affected Versions: byte struct crate versions prior to 0.6.1 Description: An issue was discovered in the byte struct crate where a drop of uninitialized memory can occur if a certain deserialization method panics. Specifically, the read bytes default le functio...

ZendTo cross-site scripting vulnerabilities

ZendTo is a completely free web-based system that lets you conveniently send or receive files with no limit on file size and faster speeds. A cross-site scripting vulnerability exists in versions prior to ZendTo 6.06-4 Beta during the display of drop-down menus with file names containing unexpect...

Regular Expression Denial of Service

Overview In affected versions of @ckeditor/ckeditor5-markdown-gfm a regular expression denial of service ReDoS vulnerability has been discovered. Impact The vulnerability allowed to abuse a link recognition regular expression, which could cause a significant performance drop resulting in a browse...