haproxy: request smuggling attack or response splitting via duplicate content-length header

Proxy server haproxy has a flaw that can could allow an HTTP request smuggling attack with the goal of bypassing access-control list rules defined by haproxy. The attack was made possible by utilizing an integer overflow vulnerability that allowed reaching an unexpected state in haproxy while...

Service Provider Console displays duplicate entries for machines when Veeam Agent is installed on Citrix VM.

Article Applicability This article documents an issue resolved in Veeam Service Provider Console 7. Challenge When VMs on Citrix Hypervisor formerly known as XenServer that is orchestrated by Cloudstack Apache or Azure Stack Hub and using Veeam Agent for Microsoft Windows or for Linux are managed...

Huawei HarmonyOS 代码问题漏洞

Huawei HarmonyOS is an operating system from Huawei China Inc. A resource management error vulnerability exists in Huawei HarmonyOS, which stems from duplicate calls to freed pointers by the product's camera component. No details of the vulnerability are currently available...

CVE-2021-41610

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-27339. Reason: This candidate is a reservation duplicate of CVE-2020-27339. Notes: All CVE users should reference CVE-2020-27339 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

CVE-2021-41610

CVE-2021-41610 is a reserved/duplicate entry, not a distinct vulnerability. The Initial Description states it should reference CVE-2020-27339 instead of this candidate. Connected documents provide the public details for CVE-2020-27339 (InsydeH2O SMM driver input validation issues with fixed kerne...

CVE-2021-45817

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-11689. Reason: This candidate is a duplicate of CVE-2018-11689. Notes: All CVE users should reference CVE-2018-11689 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage...

CVE-2021-45817

CVE-2021-45817 is a duplicate of CVE-2018-11689; the available connected record (CVE-2018-11689) describes a Cross-Site Scripting vulnerability in Hanwha DVR Web Viewer 2.17 and Samsung Web Viewer, exploitable via the /cgi-bin/webviewer_login_page data3 parameter. The same Web Viewer codebase was...

CVE-2021-3095

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-43551. Reason: This candidate is a reservation duplicate of CVE-2021-43551. Notes: All CVE users should reference CVE-2021-43551 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

CVE-2021-3095

The CVE-2021-3095 entry is a reservation duplicate of CVE-2021-43551. The connected CVE-2021-43551 describes a cross-site scripting vulnerability in OSIsoft PI Vision: a remote attacker with write access can inject code into a display, leading to unauthorized information disclosure, modification,...

CVE-2021-3090

CVE-2021-3090 is rejected/not used; this candidate is a reservation duplicate of CVE-2021-43553.

Cross-Site Request Forgery (CSRF) in zikula-modules/content

Description There is no csrf protection for content page duplicate functionality. Proof of Concept document.forms0.submit; Impact This vulnerability is capable of creating more number of duplicates by clicking malicious links...

CVE-2021-3892

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-18198. Reason: This candidate is a reservation duplicate of CVE-2019-18198. Notes: All CVE users should reference CVE-2019-18198 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

UBUNTU-CVE-2021-3892

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-18198. Reason: This candidate is a reservation duplicate of CVE-2019-18198. Notes: All CVE users should reference CVE-2019-18198 instead of this candidate. All references and descriptions in this candidate have been removed t...

CVE-2021-24739

The Logo Carousel WordPress plugin before 3.4.2 allows users with a role as low as Contributor to duplicate and view arbitrary private posts made by other users via the Carousel Duplication feature...

Duplicate Collateral could cause financial instability

Handle csanuragjain Vulnerability details Impact Duplicate collaterals can be added which makes getValidCollateral return duplicate items. This impacts all function which uses getValidCollateral function like getPendingCollRewards, which will now calculate the pending reward twice for the duplica...

SingleNativeTokenExitV2 doesn't take input deadline to consideration

Handle kenzo Vulnerability details SingleNativeTokenExitV2 takes as input from the user a deadline for the trades. However, it does not use this input for the actual trade but sets the deadline to be block.timestamp. Impact Trades will not work as expected. User might set a deadline for the trade...

MediaTek Apusys 资源管理错误漏洞

MediaTek Apusys is a chipset component from China's MediaTek Corporation MediaTek. A resource management error vulnerability exists in MediaTek Apusys, which arises from the product's apusys component making duplicate references to freed memory. An attacker could use this vulnerability to cause a...

No checks in setAddresses() functions

Handle jayjonah8 Vulnerability details Impact Since the setAddresses functions can only be called once during deployment and passes in many addresses which are set in storage, its important to have safety checks ensuring that there are no duplicate addresses which can easily happen while passing...

WordPress Duplicate Post Plugin SQL Injection (CVE-2021-43408)

An SQL injection vulnerability exists in WordPress Duplicate Post Plugin. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

CVE-2021-44948

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-44942. Reason: This candidate is a duplicate of CVE-2021-44942. Notes: All CVE users should reference CVE-2021-44942 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage...