MGASA-2021-0329 Updated botan2 packages fix security vulnerability

Updated botan2 packages fix security vulnerability: In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations base32, base58, base64, and hex CVE-2021-24115...

PT-2021-19899 · Vapor · Vapor

Name of the Vulnerable Software and Affected Versions: Vapor versions 4.47.1 and prior Description: A bug in the Data.initbase32Encoded: function opens up the potential for exposing server memory and/or crashing the server Denial of Service for applications where untrusted data can end up in said...

vapor 代码问题漏洞

vapor is a Swift web development framework for individual developers. It can be used to develop high-performance web applications and supports iOS, OS X and Ubuntu systems. A code issue vulnerability exists in Vapor 4.47.1 and earlier versions, which stems from an error in the...

DEBIAN-CVE-2021-32714

hyper is an HTTP library for Rust. In versions prior to 0.14.10, hyper's HTTP server and client code had a flaw that could trigger an integer overflow when decoding chunk sizes that are too big. This allows possible data loss, or if combined with an upstream HTTP proxy that allows chunk sizes...

CVE-2021-32714

hyper is an HTTP library for Rust. In versions prior to 0.14.10, hyper's HTTP server and client code had a flaw that could trigger an integer overflow when decoding chunk sizes that are too big. This allows possible data loss, or if combined with an upstream HTTP proxy that allows chunk sizes...

CVE-2021-32714 Integer Overflow in Chunked Transfer-Encoding

hyper is an HTTP library for Rust. In versions prior to 0.14.10, hyper's HTTP server and client code had a flaw that could trigger an integer overflow when decoding chunk sizes that are too big. This allows possible data loss, or if combined with an upstream HTTP proxy that allows chunk sizes...

Integer overflow in `hyper`'s parsing of the `Transfer-Encoding` header leads to data loss

When decoding chunk sizes that are too large, hyper's code would encounter an integer overflow. Depending on the situation, this could lead to data loss from an incorrect total size, or in rarer cases, a request smuggling attack. To be vulnerable, you must be using hyper for any HTTP/1 purpose,...

RUSTSEC-2021-0079 Integer overflow in `hyper`'s parsing of the `Transfer-Encoding` header leads to data loss

When decoding chunk sizes that are too large, hyper's code would encounter an integer overflow. Depending on the situation, this could lead to data loss from an incorrect total size, or in rarer cases, a request smuggling attack. To be vulnerable, you must be using hyper for any HTTP/1 purpose,...

Huawei EulerOS: Security Advisory for libxml2 (EulerOS-SA-2021-2103)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the PALM image encoding engine in the ImageMagick console-based graphics editor allows an attacker to trigger a service failure by exceeding the allowed buffer data size.

The vulnerability of the PALM image encoding engine in the ImageMagick graphics editor involves reading data beyond the acceptable buffer limits. Exploiting this vulnerability allows a malicious actor to cause service interruptions...

Microsoft Urges Azure Users to Update PowerShell to Patch RCE Flaw

Microsoft is urging Azure users to update the PowerShell command-line tool as soon as possible to protect against a critical remote code execution vulnerability impacting .NET Core. The issue, tracked as CVE-2021-26701 CVSS score: 8.1, affects PowerShell versions 7.0 and 7.1 and have been...

EulerOS Virtualization for ARM 64 3.0.2.0 : libxml2 (EulerOS-SA-2021-2103)

According to the versions of the libxml2 packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML...

The vulnerability of DHCP clients for UNIX-based command-line tools like BusyBox, related to integer overflows in value manipulation, allows attackers to trigger a service failure.

The vulnerability of DHCP clients that use UNIX command-line utilities with BusyBox is related to integer overflows. Exploiting this vulnerability allows an attacker to cause a service failure by using a modified domain name with the RFC1035 encoding...

Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2021-2050)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP9 : golang (EulerOS-SA-2021-2061)

According to the version of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader for xml.NewTokenDecoder returns EOF in the...

Encoding data for POST requests

Right now, when you go to copilot.github.com you're greeted with this example: async function isPositivetext const response = await fetchhttp://text-processing.com/api/sentiment/, method: 'POST', body: text=$text, headers: 'Content-Type': 'application/x-www-form-urlencoded', , ; const json = awai...

GNU LibreDWG 资源管理错误漏洞

GNU LibreDWG is a C library for processing DWG files from the GNU community. GNU LibreDWG is vulnerable due to a double-free in bitchainfree from dwg encodeMTEXT and dwgencodeaddobject calls. No detailed vulnerability details are currently available...

Command Execution Vulnerability in OTCMS (PHP Version)

Nettitanium CMS OTCMS PHP version based on PHP sqlite/mysql technical architecture, UTF-8 coding, not only can be applied to a wide range of news/article publishing type of website, but also applicable to corporate websites. A command execution vulnerability exists in OTCMS PHP version, which can...

ruby: Potential HTTP request smuggling in WEBrick

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy which also has a po...

ruby: Potential HTTP request smuggling in WEBrick

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy which also has a po...