8436 matches found
snakeyaml: Billion laughs attack via alias feature
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564...
Contao 代码注入漏洞
Contao is an open source content management system CMS developed using PHP. The system supports search engines, rights management, and CSS frameworks. Contao has a security vulnerability that can be exploited by an attacker to load PHP files by entering an insertion token in the Contao backend...
AT&T Labs Xmill 缓冲区错误漏洞
AT&T Labs Xmill is a new tool for efficient compression of XML data from AT&T Labs, USA. A security vulnerability exists in the XML Decompression LabelDict::Load function in AT&T Labs Xmill version 0.7. An attacker could exploit the vulnerability to remotely execute code...
PYSEC-2021-118
The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim...
microcode_ctl security, bug fix and enhancement update
4:20210216-1.20210608.0.1 - add support for UEK6 kernels - enable early update for 06-4f-01 - remove no longer appropriate caveats for 06-2d-07 and 06-55-04 - enable early and late load on RHCK 4:20210216-1.20210608.1 - Update Intel CPU microcode to microcode-20210608 release: - Fixes in...
SAMSUNG SmartThings 安全漏洞
SAMSUNG SmartThings is an app from South Korea's Samsung SAMSUNG that connects smart devices. A security vulnerability exists in SAMSUNG SmartThings versions prior to 1.7.67.25, which stems from the application allowing untrusted applications to arbitrarily load web pages in the webview...
CVE-2021-32813
Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.4.13, there exists a potential header vulnerability in Traefik's handling of the Connection header. Active exploitation of this issue is unlikely, as it requires that a removed header would lead to a privilege escalation,...
CVE-2021-32813
Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.4.13, there exists a potential header vulnerability in Traefik's handling of the Connection header. Active exploitation of this issue is unlikely, as it requires that a removed header would lead to a privilege escalation,...
Design/Logic Flaw
Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.4.13, there exists a potential header vulnerability in Traefik's handling of the Connection header. Active exploitation of this issue is unlikely, as it requires that a removed header would lead to a privilege escalation,...
CVE-2021-32813
The CVE-2021-32813 issue affects Traefik (HTTP reverse proxy/load balancer). Before v2.4.13, Traefik’s handling of the Connection header can remove a request header if a middleware chain sets a header and the request uses a specific Connection header, potentially preventing the backend from seein...
Virtuozzo Hybrid Infrastructure 4.6 Update 1
This update provides new features, as well as bug fixes and improvements. Vulnerability id: VSTOR-45315 The MDS service may be unstable under a high load condition. Vulnerability id: VSTOR-43126 A deadlock is possible between atomic and non-atomic commands in the iSCSI kernel module. Vulnerabilit...
Updated xstream packages fix security vulnerabilities
In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream CVE-2021-21341...
UBUNTU-CVE-2021-32686
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP before version 2.11.1, there are a couple of issues found in the SSL socket. First, a race condition between callback a...
PT-2021-6700
Name of the Vulnerable Software and Affected Versions PJSIP versions prior to 2.11.1 Description The issue is related to the SSL socket in PJSIP, a free and open source multimedia communication library. It involves a race condition between callback and destroy due to the accepted socket having no...
Oracle Application Testing Suite (Jul 2021 CPU)
The 13.3.0.1 versions of Application Testing Suite installed on the remote host are affected by a vulnerability as referenced in the July 2021 CPU advisory. - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager component: Load Testing for Web Apps Apache...
CVE-2020-5316
Dell SupportAssist for Business PCs versions 2.0, 2.0.1, 2.0.2, 2.1, 2.1.1, 2.1.2, 2.1.3 and Dell SupportAssist for Home PCs version 2.0, 2.0.1, 2.0.2, 2.1, 2.1.1, 2.1.2, 2.1.3, 2.2, 2.2.1, 2.2.2, 2.2.3, 3.0, 3.0.1, 3.0.2, 3.1, 3.2, 3.2.1, 3.2.2, 3.3, 3.3.1, 3.3.2, 3.3.3, 3.4 contain an...
PT-2021-7967 · Unknown +2 · Stb Image.H +2
Name of the Vulnerable Software and Affected Versions: stb image.h version 2.27 Description: The issue is related to a heap-based buffer overflow in the stbi jpeg load function of the stb image.h library, which can lead to Information Disclosure or Denial of Service. This can be exploited by a...
Citrix ADM: Incorrect status of service under LB "Going out of Service"
When Admin is trying to disable the service of Load balancing V-server from ADM, encounters Going Out of service On ADC same service is being marked OUT OF SERVICE as expected On ADC we see, the status of service correctly changed to "Out of Service": But on ADM, status of service still shows GOI...
Cilium - eBPF-based Networking, Security, And Observability
Cilium is open source software for providing and transparently securing network connectivity and loadbalancing between application workloads such as application containers or processes. Cilium operates at Layer 3/4 to provide traditional networking and security services as well as Layer 7 to...
