urllib3: Request body not stripped after redirect from 303 status changes request method to GET

A flaw was found in urllib3, an HTTP client library for Python. urllib3 doesn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303, after changing the method in a request from one that could accept a request body such as POST to GET, as is required by HTTP...

CVE-2024-4563 The Progress MOVEit Automation Configuration Export Function Uses a Cryptographic Method with Insufficient Bit Length

The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length...

CVE-2024-4563 The Progress MOVEit Automation Configuration Export Function Uses a Cryptographic Method with Insufficient Bit Length

The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length...

urllib3: Request body not stripped after redirect from 303 status changes request method to GET

A flaw was found in urllib3, an HTTP client library for Python. urllib3 doesn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303, after changing the method in a request from one that could accept a request body such as POST to GET, as is required by HTTP...

urllib3: Request body not stripped after redirect from 303 status changes request method to GET

A flaw was found in urllib3, an HTTP client library for Python. urllib3 doesn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303, after changing the method in a request from one that could accept a request body such as POST to GET, as is required by HTTP...

urllib3: Request body not stripped after redirect from 303 status changes request method to GET

A flaw was found in urllib3, an HTTP client library for Python. urllib3 doesn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303, after changing the method in a request from one that could accept a request body such as POST to GET, as is required by HTTP...

TOTOLINK CPE CP450 CloudACMunualUpdate Method Command Injection Vulnerability

TOTOLINK CPE CP450 is an outdoor wireless client terminal device from China Gion Electronics TOTOLINK, which is mainly used to provide wireless broadband access services, especially for wireless network coverage in rural or remote areas. A command injection vulnerability exists in the TOTOLINK CP...

TOTOLINK CP450 setIpPortFilterRules method buffer overflow vulnerability

TOTOLINK CP450 is a wireless bridge from China Gion Electronics TOTOLINK. The TOTOLINK CP450 suffers from a buffer overflow vulnerability that originates from the setIpPortFilterRules method failing to properly validate the length and size of the input data, which can be exploited by an attacker ...

TOTOLINK CP450 getSaveConfig method buffer overflow vulnerability

TOTOLINK CP450 is a wireless bridge from China Gion Electronics TOTOLINK. The TOTOLINK CP450 suffers from a buffer overflow vulnerability that stems from the getSaveConfig method failing to properly validate the length and size of the input data, which can be exploited by an attacker to cause a...

TOTOLINK CPE CP450 setUpgradeFW Method Command Injection Vulnerability

TOTOLINK CPE CP450 is an outdoor wireless client terminal device manufactured by China Gion Electronics TOTOLINK. The TOTOLINK CPE CP450 suffers from a command injection vulnerability that stems from the FileName parameter of the setUpgradeFW method failing to properly filter constructor command...

TOTOLINK CP450 addWlProfileClientMode method buffer overflow vulnerability

TOTOLINK CP450 is a wireless bridge from China Gion Electronics TOTOLINK. The TOTOLINK CP450 suffers from a buffer overflow vulnerability that stems from the addWlProfileClientMode method failing to correctly validate the length size of the input data, no details of the vulnerability are provided...

TOTOLINK CPE CP450 NTPSyncWithHost Method Command Injection Vulnerability

TOTOLINK CPE CP450 is an outdoor wireless client terminal device from China Gion Electronics TOTOLINK, which is mainly used to provide wireless broadband access services, especially for wireless network coverage in rural or remote areas. A command injection vulnerability exists in the TOTOLINK CP...

TOTOLINK CP450 CloudACMunualUpdate method buffer overflow vulnerability

TOTOLINK CP450 is a wireless bridge from China Gion Electronics TOTOLINK. The TOTOLINK CP450 suffers from a buffer overflow vulnerability that stems from the CloudACMunualUpdate method failing to properly validate the length size of input data, which can be exploited by an attacker to cause a...

LAquis SCADA LGX Report Processing AddComboFile Path Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of LAquis SCADA. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the implementation of...

CVE-2021-47277

In the Linux kernel, the following vulnerability has been resolved: kvm: avoid speculation-based attacks from out-of-range memslot accesses KVM's mechanism for accessing guest memory translates a guest physical address gpa to a host virtual address using the right-shifted gpa also known as gfn an...

CVE-2021-47375

In the Linux kernel, the following vulnerability has been resolved: blktrace: Fix uaf in blktrace access after removing by sysfs There is an use-after-free problem triggered by following process: P1sda P2sdb echo 0 /sys/block/sdb/trace/enable blktraceremovequeue synchronizercu blktracefree...

CVE-2021-47362

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Update intermediate power state for SI Update the current state as boot state during dpm initialization. During the subsequent initialization, setpowerstate gets called to transition to the final power state...

CVE-2021-47387 cpufreq: schedutil: Use kobject release() method to free sugov_tunables

In the Linux kernel, the following vulnerability has been resolved: cpufreq: schedutil: Use kobject release method to free sugovtunables The struct sugovtunables is protected by the kobject, so we can't free it directly. Otherwise we would get a call trace like this: ODEBUG: free active active...

CVE-2021-47362 drm/amd/pm: Update intermediate power state for SI

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Update intermediate power state for SI Update the current state as boot state during dpm initialization. During the subsequent initialization, setpowerstate gets called to transition to the final power state...

CVE-2021-47362

CVE-2021-47362 affects the Linux kernel’s drm/amd/pm power management code. The vulnerability occurs during DPM initialization when set_power_state reads values from the current state; if current state is not populated, this can lead to a NULL pointer dereference. The ATCS/ACPI path for PCI speed...