CVE-2021-43350 LDAP filter injection vulnerability in Traffic Ops

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter...

CVE-2021-43350: Improper Neutralization of Special Elements used in an LDAP Query

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter...

Heap OOB read in all `tf.raw_ops.QuantizeAndDequantizeV*` ops

Impact The shape inference functions for the QuantizeAndDequantizeV operations can trigger a read outside of bounds of heap allocated array as illustrated in the following sets of PoCs: python import tensorflow as tf @tf.function def test: data=tf.rawops.QuantizeAndDequantizeV4Grad...

File Permission Vulnerability in Hitachi Automation Director, Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center

Overview A file permission vulnerability was found in Hitachi Automation Director, Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer to the 'Vendor Information' section for...

PT-2021-30165

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 5.14.11 Description The issue is related to a potential security vulnerability in the Linux Kernel, where the rq qos ops-done bio function is called even if the bio isn't tracked. The actual impact and attack...

PT-2021-26170

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to 5.14.11 Description: The issue is related to a potential security vulnerability in the Linux Kernel. It involves not calling rq qos ops-done bio if the bio isn't tracked. The actual impact and attack plausibilit...

CVE-2021-40720

Ops CLI version 2.0.4 and earlier is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrary code execution when the checkoutrepo function is called on a maliciously crafted file. An attacker can leverage this to execute arbitrary code on the victim machine...

CVE-2021-40720

Ops CLI version 2.0.4 and earlier is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrary code execution when the checkoutrepo function is called on a maliciously crafted file. An attacker can leverage this to execute arbitrary code on the victim machine...

Deserialization of untrusted data

Ops CLI version 2.0.4 and earlier is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrary code execution when the checkoutrepo function is called on a maliciously crafted file. An attacker can leverage this to execute arbitrary code on the victim machine...

PYSEC-2021-380

Ops CLI version 2.0.4 and earlier is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrary code execution when the checkoutrepo function is called on a maliciously crafted file. An attacker can leverage this to execute arbitrary code on the victim machine...

CVE-2021-40720 Ops CLI Deserialization of Untrusted Data leads to Abritrary Code Execution

Ops CLI version 2.0.4 and earlier is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrary code execution when the checkoutrepo function is called on a maliciously crafted file. An attacker can leverage this to execute arbitrary code on the victim machine...

CVE-2021-40720

Ops CLI version 2.0.4 and earlier is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrary code execution when the checkoutrepo function is called on a maliciously crafted file. An attacker can leverage this to execute arbitrary code on the victim machine...

CVE-2021-40720

Ops CLI (version 2.0.4 and earlier) is affected by a Deserialization of Untrusted Data vulnerability in the checkout_repo function that allows arbitrary code execution when processing a malicious file. This is documented across multiple sources (e.g., Veracode and OSV/GHSA entries) as a vulnerabi...

Apache Traffic Control input validation error vulnerability

Apache Traffic Control is a distributed and scalable content distribution solution from the Apache Foundation. Apache Traffic Control Traffic Ops is vulnerable to an input validation error, which is caused when an authenticated Apache Traffic Control Traffic Ops user with portal-level privileges...

PT-2021-22946

Name of the Vulnerable Software and Affected Versions Ops CLI versions 2.0.4 and earlier Description The issue is related to Deserialization of Untrusted Data, allowing arbitrary code execution when the checkout repo function is called on a maliciously crafted file. This enables an attacker to...

CVE-2021-40720: Deserialization of Untrusted Data

Ops CLI version 2.0.4 and earlier is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrary code execution when the checkoutrepo function is called on a maliciously crafted file. An attacker can leverage this to execute arbitrary code on the victim machine...

Adobe Ops-cli 代码问题漏洞

Adobe Ops-cli is a Cli wrapper for Terraform, Ansible, Helmfile, and Ssh for cloud automation from Adobe USA. A code issue vulnerability exists in Adobe ops-cli that stems from the product not doing valid validation of input data during deserialization. The vulnerability can be exploited to execu...

Email relay in Apache Traffic Control

An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint to send an email, from the Traffic Ops server, with an arbitrary body to an arbitrary email address...

GHSA-GW97-F6H8-GM94 Email relay in Apache Traffic Control

An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint to send an email, from the Traffic Ops server, with an arbitrary body to an arbitrary email address...

Improper Input Validation

An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint to send an email, from the Traffic Ops server, with an arbitrary body to an arbitrary email address...