Always-Incorrect Control Flow Implementation

Overview evm is a SputnikVM: Rust Ethereum Virtual Machine Implementation. Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation as the opcode's condition is checked after the destination validity check, while according to Geth and OpenEthereum, the...

OPENSUSE-SU-2021:1355-1 Security update for mbedtls

This update for mbedtls fixes the following issues: CVE-2021-24119: Fixed side-channel vulnerability in base64 PEM boo1189589 Guard against strong local side channel attack against base64 tables by making access aceess to them use constant flow code. This update was imported from the...

Juniper Junos OS Vulnerability (JSA11226)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA11226 advisory. - A buffer overflow vulnerability in the TCP/IP stack of Juniper Networks Junos OS allows an attacker to send specific sequences of packets to the device thereby causing a...

Juniper Networks Junos OS 代码问题漏洞

Junos OS is a FreeBSD-based operating system used in Juniper Networks hardware routers. It is the operating system used in Juniper Networks routing, switching, and security appliances. A denial of service vulnerability exists in the flow daemon flowd on the Juniper Networks Junos OS SRX300 Series...

Microsoft Excel 代码注入漏洞

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft Corporation USA. A code injection vulnerability exists in Microsoft Excel. The vulnerability arises from a network system or product not properly filtering specific elements of externally entered data during t...

CVE-2021-40683

In Akamai EAA Enterprise Application Access Client before 2.3.1, 2.4.x before 2.4.1, and 2.5.x before 2.5.3, an unquoted path may allow an attacker to hijack the flow of execution...

CVE-2021-40683

In Akamai EAA Enterprise Application Access Client before 2.3.1, 2.4.x before 2.4.1, and 2.5.x before 2.5.3, an unquoted path may allow an attacker to hijack the flow of execution...

CVE-2021-40683

The CVE-2021-40683 issue affects Akamai EAA Client on Windows prior to patches addressing unquoted path handling that could hijack the flow of execution. Affected versions include 2.3.1 and 2.4.x before 2.4.1, and 2.5.x before 2.5.3. The vulnerability, described across multiple sources, indicates...

CVE-2020-18684

Floodlight through 1.2 has an integer overflow in checkFlow in StaticFlowEntryPusherResource.java via priority or port number...

CVE-2020-18683

Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of undefined fields mishandling...

Floodlight 输入验证错误漏洞

Floodlight is a leading open source OpenFlow controller. An input validation error vulnerability exists in Floodlight version 1.2, which stems from the software having poor input validation in the checkFlow in StaticFlowEntryPusherResource.java, as there is no checking of prerequisites related to...

$8,000 Bug Bounty Highlight: XSS to RCE in the Opera Browser

Research $8,000 Bug Bounty Highlight: XSS to RCE in the Opera Browser Share September 24th, 2021 Continuing from hisprevious post, Bug Bounty Hunter Renwa writes about the second vulnerability he submitted to Opera’s Private Bug Bounty Programme: a Remote Code Execution in Opera’s My Flow Feature...

GHSA-4GF2-XV97-63M2 Exposure of Sensitive Information in keycloak

A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events...

Exposure of Sensitive Information in keycloak

A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events...

The vulnerability of the call() function in the src/parser.c component of the control flow analyzer for C source files, related to the use of memory after its release, allows a attacker to trigger a service failure.

The vulnerability of the call function in the src/parser.c component of the control flow analyzer for C source files is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure...

Reentrancy through withdrawBounty

Handle jonah1005 Vulnerability details Impact The function settleAuction Auction.solL69-L109 calls withdrawBounty. However, there's no safety checks in addBounty function.Auction.solL126-L138 The attacker can add malicious contract through addBounty and hijack the control flow of settleAuction...

CVE-2021-34573

In Enbra EWM in Version 1.7.29 together with several tested wireless M-Bus Sensors the events backflow and "no flow" are not reconized or misinterpreted. This may lead to wrong values and missing events...

Buffer overflow

In Enbra EWM in Version 1.7.29 together with several tested wireless M-Bus Sensors the events backflow and "no flow" are not reconized or misinterpreted. This may lead to wrong values and missing events...

CVE-2021-34573 Incorrect calculation in Enbra EWM does not report backflows or no flow events

In Enbra EWM in Version 1.7.29 together with several tested wireless M-Bus Sensors the events backflow and "no flow" are not reconized or misinterpreted. This may lead to wrong values and missing events...

keycloak: Anyone can register a new device when there is no device registered for passwordless login

A flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key when there is not a device already registered for any user by using the WebAuthn password-less login flow...