CVE-2021-39881

In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client application with arbitrary scope names which may allow the malicious user to trick unsuspecting users to authorize the malicious client application using the spoofed scope name and...

Unspecified Vulnerability in ZeroMQ

ZeroMQ is a lightweight distributed messaging engine core library . A security vulnerability exists in ZeroMQ server versions prior to 4.3.3, which stems from a vulnerability that allows a malicious client to cause a stack buffer overflow on the server by sending a carefully crafted topic...

RabbitMQ -- Denial of Service via improper input validation

Jonathon Knudsen of Synopsys Cybersecurity Research Center reports: All versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A malicious client can exploit the vulnerability by sending malicious AMQP...

EulerOS Virtualization 3.0.6.6 : spice-gtk (EulerOS-SA-2021-1519)

According to the versions of the spice-gtk packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system,...

CVE-2021-22977

On BIG-IP version 16.0.0-16.0.1 and 14.1.2.4-14.1.3, cooperation between malicious HTTP client code and a malicious server may cause TMM to restart and generate a core file. Note: Software versions which have reached End of Software Development EoSD are not evaluated...

BIG-IP security vulnerability

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other features. A security vulnerability exists in the BIG-IP where collaboration between malicious HTTP client code and a malicious server cou...

EulerOS 2.0 SP5 : spice (EulerOS-SA-2021-1232)

According to the version of the spice package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Bot...

PT-2021-4579

Name of the Vulnerable Software and Affected Versions QEMU versions up to and including 5.2.0 Description A race condition flaw was found in the 9pfs server implementation, allowing a malicious 9p client to cause a use-after-free error. This could potentially escalate privileges on the system, wi...

DEBIAN-CVE-2020-25708

A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to send a specially crafted message that, when processed by the VNC server, would lead to a floating point exception, resulting in a denial of service...

CVE-2020-25708

A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to send a specially crafted message that, when processed by the VNC server, would lead to a floating point exception, resulting in a denial of service...

UBUNTU-CVE-2020-25708

A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to send a specially crafted message that, when processed by the VNC server, would lead to a floating point exception, resulting in a denial of service...

MGASA-2020-0408 Updated spice and spice-gtk packages fix a security vulnerability

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client spice-gtk and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messag...

Important: spice-gtk

Issue Overview: Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system. Both the SPICE client spice-gtk and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that...

CVE-2020-5769

Teltonika TRB2 firmware TRB2_R_00.02.02 contains insufficient output sanitization in the WEB application, enabling a remote, authenticated attacker to perform persistent cross-site scripting by injecting malicious client-side code into the DATA TO SERVER fields (URL/Host/Connection). Affected: Te...

CVE-2020-4042

Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge...

CVE-2020-4042

Bareos before version 19.2.8 is vulnerable to an authentication bypass where a malicious client can replay the director’s cram-md5 challenge to the director itself, causing the director to treat the replay as a valid response to its original challenge. The issue arises when the director allows cl...

CVE-2020-4042

Removed by vendor...

Important: nghttp2

Issue Overview: In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes 2400 individual settings entries over and over again. The...

Updated nghttp2 packages fix security vulnerability

nghttp2 has been updated to version 1.41.0 to fix CVE-2020-11080. The overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes 2400 individual settings entries over and...

Double free

In FreeRDP less than or equal to 2.0.0, by providing manipulated input a malicious client can create a double free condition and crash the server. This is fixed in version 2.1.0...