Symfony Secret Fragments Remote Code Execution

The Symfony framework or Symfony based projects uses a secret that is used for its cryptographic operations such as the creation of cookies or anti-CSRF tokens. A feature not enabled by default allows to execute arbitrary PHP code via a GET parameter. If this secret is exposed, through a...

QEMU: slirp: use-after-free in ip_reass() function in ip_input.c

A use-after-free flaw was found in the SLiRP networking implementation of the QEMU emulator. Specifically, this flaw occurs in the ipreass routine while reassembling incoming IP fragments whose combined size is bigger than 65k. This flaw allows an attacker to crash the QEMU process on the host,...

CVE-2020-4640

Certain IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 configurations can result in sensitive information in the URL fragment identifiers. This information can be cached in the intermediate nodes like proxy servers, cdn, logging platforms, etc. An attacker can make u...

Freebsd FreeBSD Information Disclosure Vulnerability

FreeBSD is a set of Unix-like operating systems from the Freebsd Foundation. FreeBSD suffers from an information disclosure vulnerability that could allow a local attacker to read memory fragments via VOP READDIR to obtain sensitive information...

Freebsd FreeBSD 信息泄露漏洞

FreeBSD is a set of Unix-like operating systems from the Freebsd Foundation. A security vulnerability exists in FreeBSD that allows a local attacker to read memory fragments via VOP READDIR to obtain sensitive information. No details of the vulnerability are provided at this time...

CVE-2020-26293

HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. In HtmlSanitizer before version 5.0.372, there is a possible XSS bypass if style tag is allowed. If you have explicitly allowed the tag, an attacker could craft HTML that includ...

Design/Logic Flaw

HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. In HtmlSanitizer before version 5.0.372, there is a possible XSS bypass if style tag is allowed. If you have explicitly allowed the tag, an attacker could craft HTML that includ...

CVE-2020-26293

The provided connected documents confirm a concrete vulnerability in HtmlSanitizer (a .NET library) where an XSS bypass is possible in versions before 5.0.372 if the tag is explicitly allowed. The default policy disallows , so risk exists only when that tag is whitelisted. The issue has been fix...

Apache Traffic Server Information Disclosure Vulnerability

Apache Traffic Server ATS is the United States Apache Apache Software Foundation's set of scalable HTTP proxy and caching server. An information disclosure vulnerability exists in the Apache Traffic Server product, which can be exploited by a local attacker to read memory fragments and obtain...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel, which can be exploited by an attacker to read memory fragments via the Linux kernel's collect syscall to obtain sensitive...

Apache Traffic Server 信息泄露漏洞

Apache Traffic Server ATS is the United States Apache Apache Software Foundation's set of scalable HTTP proxy and caching server. An information disclosure vulnerability exists in the Apache Traffic Server product, which can be exploited by a local attacker to read memory fragments and obtain...

kernel: buffer overflow in mt76_add_fragment function in drivers/net/wireless/mediatek/mt76/dma.c

A memory overflow and data corruption flaw were found in the Mediatek MT76 driver module for WiFi in mt76addfragment in drivers/net/wireless/mediatek/mt76/dma.c. An oversized packet with too many rx fragments causes an overflow and corruption in memory of adjacent pages. A local attacker with a...

QEMU: slirp: use-after-free in ip_reass() function in ip_input.c

A use-after-free flaw was found in the SLiRP networking implementation of the QEMU emulator. Specifically, this flaw occurs in the ipreass routine while reassembling incoming IP fragments whose combined size is bigger than 65k. This flaw allows an attacker to crash the QEMU process on the host,...

An array overflow was discovered in mt76_add_fragment in drivers/net/wireless/mediatek/mt76/dma.c in the Linux kernel before 5.5.10 aka CID-b102f0c522cf. An oversized packet with too many rx fragments can corrupt memory of adjacent pages.

...

The Apache HTTP Server when accessed through a TCP connection with a large window size allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties who state that the large window size required by the attack is not normally supported or configured by the server or that a DDoS-style attack would accomplish the same goal

...

CVE-2020-1649 Junos OS: MX Series: PFE crash on MPC7/8/9 upon receipt of small fragments requiring reassembly

When a device running Juniper Networks Junos OS with MPC7, MPC8, or MPC9 line cards installed and the system is configured for inline IP reassembly, used by L2TP, MAP-E, GRE, and IPIP, the packet forwarding engine PFE will become disabled upon receipt of small fragments requiring reassembly,...

Arista Networks Networks CloudVision Portal IP fragment DoS (SA0037)

The version of Arista Networks CloudVision Portal running on the remote device is affected by a denial of service DoS vulnerability. The Linux kernel is vulnerable to a DoS attack with low rates of specially modified packets targeting IP fragment re-assembly. An remote, unauthenticated attacker c...

DEBIAN-CVE-2020-12465

An array overflow was discovered in mt76addfragment in drivers/net/wireless/mediatek/mt76/dma.c in the Linux kernel before 5.5.10, aka CID-b102f0c522cf. An oversized packet with too many rx fragments can corrupt memory of adjacent pages...

UBUNTU-CVE-2020-12465

An array overflow was discovered in mt76addfragment in drivers/net/wireless/mediatek/mt76/dma.c in the Linux kernel before 5.5.10, aka CID-b102f0c522cf. An oversized packet with too many rx fragments can corrupt memory of adjacent pages...

CVE-2019-9183

An issue was discovered in Contiki-NG through 4.3 and Contiki through 3.0. A buffer overflow is present due to an integer underflow during 6LoWPAN fragment processing in the face of truncated fragments in os/net/ipv6/sicslowpan.c. This results in accesses of unmapped memory, crashing the...