Input validation

NLnet Labs Routinator prior to 0.10.0 produces invalid RTR payload if an RPKI CA uses too large values in the max-length parameter in a ROA. This will lead to RTR clients such as routers to reject the RPKI data set, effectively disabling Route Origin Validation...

CVE-2021-41531

NLnet Labs Routinator (affected: versions prior to 0.10.0) contains a vulnerability where an invalid RTR payload is produced if a ROA’s max-length parameter value is too large for an RPKI CA. This causes RTR clients (e.g., routers) to reject the RPKI data set and effectively disables Route Origin...

CVE-2021-41531 Invalid RPKI data could disable Route Origin Validation on RTR clients.

NLnet Labs Routinator prior to 0.10.0 produces invalid RTR payload if an RPKI CA uses too large values in the max-length parameter in a ROA. This will lead to RTR clients such as routers to reject the RPKI data set, effectively disabling Route Origin Validation...

Juniper Junos OS DoS (JSA11185)

The version of Junos OS installed on the remote host is affected by a denial of service vulnerability as referenced in the JSA11185 advisory. - On Juniper Networks Junos OS and Junos OS Evolved devices configured with BGP origin validation using Resource Public Key Infrastructure RPKI receipt of ...

Cross-Site Request Forgery in sqlite-web

This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Reques...

CVE-2021-3761

Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. An attacker can use this to disable RPKI Origin Validation in a victim network for example AS 13335 - Cloudflare prior to launching a BGP hijack which...

CVE-2021-3761

Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. An attacker can use this to disable RPKI Origin Validation in a victim network for example AS 13335 - Cloudflare prior to launching a BGP hijack which...

UBUNTU-CVE-2021-3761

Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. An attacker can use this to disable RPKI Origin Validation in a victim network for example AS 13335 - Cloudflare prior to launching a BGP hijack which...

PYSEC-2021-332

This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Reques...

CVE-2021-3761

Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. An attacker can use this to disable RPKI Origin Validation in a victim network for example AS 13335 - Cloudflare prior to launching a BGP hijack which...

Improper Authorization and Origin Validation Error in OneFuzz

Impact Starting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authenticated user from any Azure Active Directory tenant to make authorized API calls to a vulnerable OneFuzz instance. To be vulnerable, a OneFuzz deployment must be: Version 2.12.0 or greater Deployed...

CVE-2021-37705 Improper Authorization and Origin Validation Error in OneFuzz

OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Starting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authenticated user from any Azure Active Directory tenant to make authorized API calls to a vulnerable OneFuzz instance. To be vulnerable, a...

Southsoft GMIS 跨站请求伪造漏洞

Southsoft GMIS is an information management system. A cross-site request forgery vulnerability exists in Southsoft GMIS 5.0, which arises from a WEB application that does not adequately validate that a request is coming from a trusted user. An attacker could use this vulnerability to send an...

CVE-2021-0281

On Juniper Networks Junos OS devices configured with BGP origin validation using Resource Public Key Infrastructure RPKI receipt of a specific packet from the RPKI cache server may cause routing process daemon RPD to crash and restart, creating a Denial of Service DoS condition. Continued receipt...

CVE-2021-0281

On Juniper Networks Junos OS devices configured with BGP origin validation using Resource Public Key Infrastructure RPKI receipt of a specific packet from the RPKI cache server may cause routing process daemon RPD to crash and restart, creating a Denial of Service DoS condition. Continued receipt...

Design/Logic Flaw

On Juniper Networks Junos OS devices configured with BGP origin validation using Resource Public Key Infrastructure RPKI receipt of a specific packet from the RPKI cache server may cause routing process daemon RPD to crash and restart, creating a Denial of Service DoS condition. Continued receipt...

CVE-2021-0281 Junos OS and Junos OS Evolved: Specific packets can trigger rpd crash when BGP Origin Validation is configured with RPKI

On Juniper Networks Junos OS devices configured with BGP origin validation using Resource Public Key Infrastructure RPKI receipt of a specific packet from the RPKI cache server may cause routing process daemon RPD to crash and restart, creating a Denial of Service DoS condition. Continued receipt...

CVE-2021-0281

CVE-2021-0281 affects Juniper Networks Junos OS and Junos OS Evolved. A crafted BGP origin validation/ RPki packet from the RPKI cache server can crash and restart the routing process daemon (RPD), causing a DoS. Affected releases include Junos OS 17.3 (before 17.3R3-S12), 17.4 (before 17.4R3-S5)...

AVEVA System Platform (Update A)

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable from adjacent network/low attack complexity Vendor: AVEVA Software, LLC Equipment: System Platform Vulnerabilities: Missing Authentication for Critical Function, Uncaught Exception, Path Traversal, Origin Validation Error, Improper...

Podman Origin Validation Error

Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 including from remote hosts. This impacts containerized applications that trust localhost 127.0.01 connections by default and do not require authentication. This issue affects Podman versions from 1.8.0...