14151 matches found
CVE-2021-22166
Removed by vendor...
CVE-2021-22166
An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method...
CVE-2021-22166: Uncontrolled Resource Consumption
An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method...
PT-2021-14881 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions 13.7 and later Description: An attacker could cause a denial of service in GitLab by sending an HTTP request with a method that is malformed. Recommendations: For GitLab versions 13.7 and later, update to a version that includ...
Security Bulletin: Forced Submit Using GET Vulnerability Affects IBM Emptoris Strategic Supply Management Platform (CVE-2020-4893)
Summary Web form forced to submit using GET method vulnerability affects IBM Emptoris Strategic Supply Management Platform. Vulnerability Details CVEID: CVE-2020-4893 DESCRIPTION: IBM Emptoris transmits sensitive information in HTTP GET request parameters. This may lead to information disclosure...
Klog Server 2.4.1 Command Injection
Exploit Title: Klog Server 2.4.1 - Command Injection Unauthenticated Date: 22.12.2020 Exploit Author: b3kc4t Mustafa GUNDOGDU Vendor Homepage: https://www.klogserver.com/ Version: 2.4.1 Tested On: Ubuntu 18.04 CVE: 2020-35729 Description:...
EulerOS Virtualization for ARM 64 3.0.2.0 : libX11 (EulerOS-SA-2021-1049)
According to the versions of the libX11 packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local privileged...
PT-2021-24257
Name of the Vulnerable Software and Affected Versions: binjs io crate through 2021-01-03 Description: The issue is related to the Read method, which may read from uninitialized memory locations. Affected versions of the crate pass an uninitialized buffer to a user-provided Read implementation,...
CVE-2020-35891
An issue was discovered in the ordnung crate through 2020-09-03 for Rust. compact::Vec violates memory safety via a remove double free...
qdPM 9.1 PHP Object Injection
-------------------------------------------------------------- qdPM getParameter'format'; 299. $filename = $request-getParameter'filename'; 300. 301. $export = unserialize$request-getParameter'export'; User input passed through the "export" request parameter is not properly sanitized before being...
CVE-2020-35669: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An issue was discovered in the http package through 0.12.2 for Dart. If the attacker controls the HTTP method and the app is using Request directly, it's possible to achieve CRLF injection in an HTTP request...
mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep
A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in wsrepsstmethod allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and...
RHEL 8 : mariadb:10.3 (RHSA-2020:5663)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5663 advisory. MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded ...
RHEL 8 : mariadb:10.3 (RHSA-2020:5665)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5665 advisory. MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded ...
Acronis: HTTP Request Smuggling on https://consumer.acronis.com
Summary The website https://consumer.acronis.com is vulnerable to HTTP Request Smuggling which can be abused by an attacker to redirect all the users to a malicious website. A redirect can be forced by changing the Host request header using the path /sf but the website will redirect you to...
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.
...
Rocket.Chat: Unauthenticated clients can modify Livechat Business Hours
The Meteor method "livechat:saveOfficeHours" allowed unauthenticated clients to modify the global Livechat Business Hours by directly updating the database model...
Rocket.Chat: Unread Messages can leak Message IDs
The Meteor Method "unreadMessages" could leak existing Message IDs to unauthorized clients when called with a regular expression. The vulnerability was present in Rocket.Chat versions 3.9.3 and develop...
