PYSEC-2021-859

NLTK Natural Language Toolkit is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Versions prior to 3.6.5 are vulnerable to regular expression denial of service ReDoS attacks. The vulnerability is present in...

Input validation

NLTK Natural Language Toolkit is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Versions prior to 3.6.5 are vulnerable to regular expression denial of service ReDoS attacks. The vulnerability is present in...

CVE-2021-43854

NLTK Natural Language Toolkit is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Versions prior to 3.6.5 are vulnerable to regular expression denial of service ReDoS attacks. The vulnerability is present in...

CVE-2021-43854

CVE-2021-43854 affects the Python package NLTK. Versions prior to 3.6.5 are vulnerable to a Regular Expression Denial of Service (ReDoS) in the affected tokenizers: PunktSentenceTokenizer, sent_tokenize, and word_tokenize. The issue arises from inefficient regex backtracking on crafted inputs, ca...

OPENSUSE-SU-2021:4186-1 Security update for go1.17

This update for go1.17 fixes the following issues: Updated to upstream version 1.17.5 to include fixes to the compiler, linker, syscall, runtime, the net/http, go/types, and time packages bsc1190649 - CVE-2021-44717: syscall: don't close fd 0 on ForkExec error bsc1193598. - CVE-2021-44716:...

Unbounded number of Collateral

Handle gzeon Vulnerability details Impact Each additional collateral will increase gas required for many operations, e.g. Liquidation. If there are too many collateral it may exceed the block gas limit. Proof of Concept Recommended Mitigation Steps Define a max number of collateral asset --- The...

CVE-2021-43987

An additional, nondocumented administrative account exists in mySCADA myPRO Versions 8.20.0 and prior that is not exposed through the web interface, which cannot be deleted or changed through the regular web interface...

GSD-2021-1002513 ALSA: pcm: oss: Limit the period size to 16MB

ALSA: pcm: oss: Limit the period size to 16MB This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.85 by commit...

GSD-2021-1002460 ALSA: pcm: oss: Limit the period size to 16MB

ALSA: pcm: oss: Limit the period size to 16MB This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.165 by commit...

GSD-2021-1002429 ALSA: pcm: oss: Limit the period size to 16MB

ALSA: pcm: oss: Limit the period size to 16MB This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.221 by commit...

GSD-2021-1002407 ALSA: pcm: oss: Limit the period size to 16MB

ALSA: pcm: oss: Limit the period size to 16MB This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.258 by commit...

GSD-2021-1002366 ALSA: pcm: oss: Limit the period size to 16MB

ALSA: pcm: oss: Limit the period size to 16MB This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.4.295 by commit...

PT-2021-26834

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.4.295 Description: The issue is related to the ALSA pcm oss component, where the period size is limited to 16MB. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

PT-2021-27065

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.8 Description The issue is related to the ALSA pcm oss component, where the period size is limited to 16MB. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kern...

PT-2021-26851

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.293 Description The issue is related to the ALSA pcm oss component, where the period size is limited to 16MB. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

NumPy 缓冲区错误漏洞

NumPy is a Python scientific computing package. NumPy version 1.9 is vulnerable to a buffer overflow vulnerability caused by the lack of a limit on array length in the PyArrayNewFromDescrint function in ctor .c, which leads to a buffer overflow vulnerability that can be exploited to cause a denia...

plasson-pead.com.br Cross Site Scripting vulnerability OBB-2304264

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until...

jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until...

Reddit: No rate limit on password reset leads to email enumeration at gateway-production.dubsmash.com

Summary: i found brute force on gateway-production.dubsmash.com . find valid usersnames and emails no rate limit Impact: attacker could collect all usernames and valid emails through brute force on forget password Steps To Reproduce: open gateway-production.dubsmash.com and forget email and enter...