12315 matches found
RedHat redhat-certification authorization issue vulnerability
Red Hat Certification is a software package from Red Hat USA. A security vulnerability exists in redhat-certification 7 that allows an unauthenticated user to invoke the "restart" RPC method on any accessible host. An attacker could exploit this vulnerability to cause a denial of service...
CVE-2021-1527
A vulnerability in Cisco Webex Player for Windows and MacOS could allow an attacker to cause the affected software to terminate or to gain access to memory state information that is related to the vulnerable application. The vulnerability is due to insufficient validation of values in Webex...
bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible
A flaw was found in bouncycastle. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password allowing incorrect passwords to indicate they were matching with previously hashed ones that were different. The highest threat from this vulnerability is to data...
CVE-2021-30179
Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invocation and use the Java Reflection API...
CVE-2021-30179
Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invocation and use the Java Reflection API...
Server side request forgery (ssrf)
In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability...
openSUSE Security Update : rubygem-actionpack-5_1 (openSUSE-2021-797)
This update for rubygem-actionpack-51 fixes the following issues : - CVE-2021-22885: Fixed possible information disclosure / unintended method execution in Action Pack bsc1185715. This update was imported from the SUSE:SLE-15:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security,...
PT-2021-24353 · Amazon Web Services · Aws Encryption Sdk For Java
Name of the Vulnerable Software and Affected Versions: AWS Encryption SDK for Java versions 2.0.0 through 2.2.0 AWS Encryption SDK for Java versions less than 1.9.0 Description: The issue concerns the incorrect validation of some invalid ECDSA signatures. This affects the integrity of the...
GSD-2021-1000159 ACPI: custom_method: fix potential use-after-free issue
ACPI: custommethod: fix potential use-after-free issue This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.36 by commit...
GSD-2021-1000183 ACPI: custom_method: fix potential use-after-free issue
ACPI: custommethod: fix potential use-after-free issue This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.118 by commit...
GSD-2021-1000154 ACPI: custom_method: fix potential use-after-free issue
ACPI: custommethod: fix potential use-after-free issue This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.36 by commit...
UVI-2021-1000159 ACPI: custom_method: fix potential use-after-free issue
ACPI: custommethod: fix potential use-after-free issue This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.36 by commit...
GSD-2021-1000081 ACPI: custom_method: fix potential use-after-free issue
ACPI: custommethod: fix potential use-after-free issue This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.12.3 by commit...
UVI-2021-1000121 ACPI: custom_method: fix potential use-after-free issue
ACPI: custommethod: fix potential use-after-free issue This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.11.20 by commit...
CVE-2021-30179
Apache Dubbo CVE-2021-30179 affects versions prior to 2.6.9 and 2.7.9. The vulnerability arises because GenericFilter allows generic calls to arbitrary methods on provider interfaces, using Java Reflection. The invocation of $invoke/$invokeAsync uses a first argument method name, parameter types,...
Regular Expression Denial Of Service (ReDoS)
trim-newlines is vulnerable to Regular Expression Denial Of Service ReDoS. The usage of an insecure regular expression in the .end method allows an attacker to cause excessive resource consumption...
MTN Group: Reflected XSS on dailydeals.mtn.co.za
Hello MTN Team. i found Reflected XSS on https://dailydeals.mtn.co.za/index.cfm?GO=DEALS vi cpID parameter with POST method Steps To Reproduce: 1. Intercept the https://dailydeals.mtn.co.za/index.cfm?GO=DEALS 2. Change Method to POST 3. Add empty line after last header 4. Write this code...
CVE-2021-33623
The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service ReDoS for the .end method...