Regular Expression Denial of Service (ReDoS)

Overview trim-off-newlines is a Similar to Stringtrim but removes only newlines Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via string processing. PoC const trim = require'trim-off-newlines'; for let i=10; i 25; i += 1 const s = 'a' + "rn".repeat...

CVE-2021-23017

A flaw was found in nginx. An off-by-one error while processing DNS responses allows a network attacker to write a dot character out of bounds in a heap allocated buffer which can allow overwriting the least significant byte of next heap chunk metadata likely leading to a remote code execution in...

nginx 1.20.0 DNS Resolver Off-By-One Heap Write

Advisory X41-2021-002: nginx DNS Resolver Off-by-One Heap Write Vulnerability ============================================================================= Severity Rating: High Confirmed Affected Versions: 0.6.18 - 1.20.0 Confirmed Patched Versions: 1.21.0, 1.20.1 Vendor: F5, Inc. Vendor URL:...

Nginx < 1.20.1 Off-By-One Heap Write

According to its self-reported version number, the detected version of nginx is prior to 1.20.1. It is, therefore, affected by an off-by-one error in ngxresolvercopy while processing DNS responses. Note that the scanner has not tested for these issues but has instead relied only on the...

GHSA-JFP7-4J67-8R3Q Heap buffer overflow caused by rounding

Impact An attacker can trigger a heap buffer overflow in tf.rawops.QuantizedResizeBilinear by manipulating input values so that float rounding results in off-by-one error in accessing image elements: python import tensorflow as tf l = 256, 328, 361, 17, 361, 361, 361, 361, 361, 361, 361, 361, 361...

EFB Tampering 3. Take-off pt1

Take-off Performance Part 1: Introduction, Thrust & Speeds TL;DR Take-off performance applications perform calculations to provide critical take-off performance data to pilots e.g. thrust/trim/flap setting for take-off Modifying any one of these could have severe consequences. For example, an...

EFB Tampering 3. Take-off pt2

Take-off Performance Part 2: Flap, Trim, Database and Sources of Data Target: FLAP SETTING There are various forms of flaps and slats. The difference between the two and the technicalities of how they work is outside the scope of this blog. As a general rule flaps extend from the rear/trailing ed...

PYSEC-2021-655

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a heap buffer overflow in tf.rawops.QuantizedResizeBilinear by manipulating input values so that float rounding results in off-by-one error in accessing image elements. This is because the...

CVE-2021-29529: Incorrect Calculation of Buffer Size

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a heap buffer overflow in tf.rawops.QuantizedResizeBilinear by manipulating input values so that float rounding results in off-by-one error in accessing image elements. This is because the...

Johnson Controls Sensormatic Tyco AI

1. EXECUTIVE SUMMARY CVSS v3 7.0 Vendor: Sensormatic Electronics, LLC, a subsidiary of Johnson Controls Equipment: Tyco AI Vulnerability: Off-by-one Error 2. RISK EVALUATION Under specific circumstances, a local attacker could use this vulnerability to obtain super-user access to the underlying...

How Amazon Sidewalk Works—and Why You May Want to Turn It Off

The premise is convenient. But the ecommerce giant’s record on privacy isn't exactly inspiring...

DEBIAN-CVE-2020-28016

Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because "-F ''" is mishandled by parsefixphrase...

CVE-2020-28016

Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because "-F ''" is mishandled by parsefixphrase...

Why now is the time to make database security a priority

Today, fast-growing organizations are generating data at a breakneck pace, and building up diverse database environments in order to store and share data more effectively. While these activities are the sign of a thriving business, governing and securing all this data rarely meets the pace of new...

CVE-2020-28016

Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because "-F ''" is mishandled by parsefixphrase...

CVE-2020-28016

Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because "-F ''" is mishandled by parsefixphrase...

PT-2024-11083

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the Linux kernel's bpf Berkeley Packet Filter functionality, specifically with the masking negation logic when the off reg is in the dst register. The negation...

EulerOS 2.0 SP3 : dnsmasq (EulerOS-SA-2021-1775)

According to the versions of the dnsmasq packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC records could be...

CVE-2021-31875

In mjsjson.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjsjsonparse, which can potentially lead to redirection of control flow. NOTE: the original reporter disputes the significance of this finding because "there isn’t...

PT-2021-19559 · Cesanta · Mongooseos Mjs

Name of the Vulnerable Software and Affected Versions: Cesanta MongooseOS mJS version 1.26 Description: A maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs json parse, potentially leading to redirection of control flow. The original reporter disputes the...