Corel Parallels Desktop 权限许可和访问控制问题漏洞

Corel Parallels Desktop is a suite of virtual machine software for the macOS platform from Corel Canada. A privilege-granting and access control issue vulnerability exists in Corel Parallels Desktop that stems from a lack of proper validation of the length of user-supplied data before copying it ...

CVE-2021-34863

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the var:page parameter provided to the webpr...

CLSA-2021-1634925634 Fixed 9 CVEs in squid34

CVE-2020-15049: fix incorrect validation of Content-Length field leading to Http smuggling and Poisoning attack - CVE-2020-14058: fix handling of unknown SSL errors which resulted in denial of service - CVE-2020-25097: fix improper input validation allowing HTTP smuggling from trusted client -...

netty: Request smuggling via content-length header

A flaw was found in Netty. There is an issue where the content-length header is not validated correctly if the request uses a single Http2HeaderFrame with the endstream set to true. This flaw leads to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. The...

Buffer overflow

Possible buffer over read due to improper validation of frame length while processing AEAD decryption during ASSOC response in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon...

Oracle MySQL Cluster 缓冲区错误漏洞

MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database designed to guarantee 99.999% availability. A buffer overflow vulnerability exists in Oracle MySQL Cluster, which stems from a failure to validate the correct length of user-supplied data before copying it to a...

Foxit PDF Reader 缓冲区错误漏洞

A security vulnerability exists in Foxit PDF Reader JPG2000, which is caused by a lack of proper validation of the length of user-supplied data before it is copied to the heap buffer. An attacker could exploit this vulnerability to execute arbitrary code on an affected Foxit PDF Reader installati...

Schneider Electric IGSS 安全漏洞

Schneider Electric IGSS is a multi-player collaborative application from the French company Schneider Electric. A security vulnerability exists in Schneider Electric IGSS Data Collector v15.0.0.21243 and prior versions, which stems from a lack of length checking of user-supplied data. An attacker...

多款Qualcomm产品缓冲区错误漏洞

Qualcomm chips are chips from Qualcomm, Inc. A way to miniaturize circuits mainly semiconductor devices, but also passive components, etc., and is often manufactured on the surface of semiconductor wafers. Several Qualcomm Snapdragon products are vulnerable to a buffer overflow. The vulnerability...

CVE-2021-38408

A stack-based buffer overflow vulnerability in Advantech WebAccess Versions 9.02 and prior caused by a lack of proper validation of the length of user-supplied data may allow remote code execution...

CVE-2021-1930

Possible out of bounds read due to incorrect validation of incoming buffer length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile...

CLSA-2021-1629902677 Fix of CVE: CVE-2020-14058, CVE-2020-15049

CVE-2020-14058: fix handling of unknown SSL errors which resulted in denial of service - CVE-2020-15049: fix incorrect validation of Content-Length field leading to Http smuggling and Poisoning attack...

In drivers/char/virtio_console.c in the Linux kernel before 5.13.4 data corruption or loss can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE: the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the length validation was added solely for robustness in the face of anomalous host OS behavior

...

CVE-2021-38160

In drivers/char/virtioconsole.c in the Linux kernel before 5.13.4, data corruption or loss can be triggered by an untrusted device that supplies a buf-len value exceeding the buffer size. NOTE: the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; th...

HCC Embedded InterNiche Input Validation Error Vulnerability

HCC Embedded InterNiche is a newsletter software. An input validation error vulnerability exists in the HCC Embedded InterNiche stack that stems from a lack of IP length validation, which allows an attacker to send specially crafted IP packets to trigger an integer overflow...

Qualcomm多款产品 缓冲区错误漏洞

The Qualcomm Snapdragon SOC Snapdragon Processor is a chip from Qualcomm Incorporated that is used in mobile devices to process information. A buffer error vulnerability exists in multiple Qualcomm products that stems from incorrect validation of incoming buffer lengths, which could result in...

Input validation

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager vGPU plugin, where it improperly validates the length field in a request from a guest. This flaw allows a malicious guest to send a length field that is inconsistent with the actual length of the input, which may lead to...

Security Bulletin: A vulnerability in netty affects IBM Spectrum Scale Transparent Cloud Tier CVE-2021-21409

Summary Netty is used by IBM Spectrum Scale Transparent Cloud Tiering. IBM Spectrum Scale Transparent Cloud Tiering has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2021-21409 DESCRIPTION: Netty is vulnerable to request smuggling, caused by improper validation of request, caused...

D-Link DAP-1330 安全漏洞

D-Link DAP-1330 is a network device a WIFI device from AUO D-Link, Taiwan, China. A security vulnerability exists in the D-Link DAP-1330 1.13B01 BETA, which originates from a failure to properly validate the length of user-supplied data before copying it into a fixed-length buffer. An attacker...

D-Link DAP-1330 缓冲区错误漏洞

D-Link DAP-1330 is a network device a WIFI device from AUO D-Link, Taiwan, China. The D-Link DAP-1330 suffers from a buffer error vulnerability that arises from a failure to properly validate the length of user-supplied data before copying it into a fixed-length buffer. An attacker could exploit...