python-lxml: mXSS due to the use of improper parser

A Cross-site Scripting XSS vulnerability was found in the python-lxml's clean module. The module's parser did not properly imitate browsers, causing different behaviors between the sanitizer and the user's page. This flaw allows a remote attacker to run arbitrary HTML/JS code. The highest threat...

GitLab has an unspecified vulnerability (CNVD-2021-66915)

GitLab is a self-hosted, Git version control system project repository application developed in Ruby on Rails by GitLab, Inc. The application can be used to access a project's file content, commit history, bug list, etc. A security vulnerability exists in Gitlab, which stems from the product's la...

GitLab 安全漏洞

GitLab is a self-hosted, Git version control system project repository application developed in Ruby on Rails by GitLab, Inc. The application can be used to access a project's file content, commit history, bug list, etc. A security vulnerability exists in Gitlab, which stems from the product's la...

Ping Identity RSA SecurID Integration Kit 访问控制错误漏洞

The Ping Identity RSA SecurID Integration Kit is Ping Identity's PingFederate Integration Kit for RSA SecurID® that adds Identity Provider IdP integration options to PingFederate by providing an RSA SecurID adapter that acts as an RSA® Authentication Agent. Program IdP integration option to...

CVE-2021-3713

An out-of-bounds write flaw was found in the UAS USB Attached SCSI device emulation of QEMU. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice-data3 and UASDevice-status3 fields. A malicious guest user could use this flaw to crash...

unicorn:fuzz_emu_mips_32be: Heap-buffer-overflow in gen_mttr

Project: https://github.com/unicorn-engine/unicorn.git Detailed Report: https://oss-fuzz.com/testcase?key=5660760754749440 Project: unicorn Fuzzing Engine: libFuzzer Fuzz Target: fuzzemumips32be Job Type: libfuzzerasanunicorn Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Addres...

Deamon Tools Pro 输入验证错误漏洞

Deamon Tools Pro is a simulation emulation software that facilitates the creation and installation of images. An input validation error vulnerability exists in Deamon Tools Pro. No information about this vulnerability is available at this time, so please stay tuned to CNNVD or the vendor...

PT-2021-5461

Name of the Vulnerable Software and Affected Versions QEMU versions prior to 6.2.0-rc0 Description The issue is related to the UAS USB Attached SCSI device emulation of QEMU, where a lack of validation of the stream number can be exploited. This allows an attacker to access confidential data,...

Denial Of Service (DoS)

qemu is vulnerable to denial of service. A NULL pointer dereference flaw in the SCSI emulation support allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service...

Palo Alto Networks PAN-OS 安全特征问题漏洞

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. A security vulnerability exists in the Palo Alto Networks PAN-OS web interface that stems from the affected product's use of a cryptographically weak pseudo-random number generator...

QEMU: net: Infinite loop in loopback mode may lead to stack overflow

A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS...

Tenacity – An Adversary Emulation Tool for Persistence

Persistence is one of the more sought-after techniques of an attacker or adversary. Persistence is achieved through a set of tactics or techniques that adversaries use to maintain their foothold on compromised systems across restarts, changed credentials, and other interruptions that could cut of...

Design/Logic Flaw

A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free with faked heap chunk...

CVE-2021-3682

A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free with faked heap chunk...

CVE-2021-3682

A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free with faked heap chunk...

CVE-2021-3682

A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free with faked heap chunk...

Cisco Packet Tracer for Windows DLL Injection Vulnerability

Cisco Packet Tracer is a cross-platform visual emulation tool that allows users to create network topologies and emulate computer networks. The vulnerability can be exploited to execute arbitrary code on the affected system with the privileges of another user account by inserting a configuration...

QEMU 安全漏洞

QEMU Quick Emulator is a set of simulation processor software by Fabrice Bellard, a French individual developer. The software is fast and cross-platform. A security vulnerability exists in QEMU that stems from a flaw found in USB redirection device emulation in versions of QEMU prior to 6.1.0-rc2...

GitLab 授权问题漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug list, and more. An authorization issue vulnerability exists in GitLab that...

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.

...