Google Chrome GPU Graphics Processor System Failure Execution Code

The vulnerability of Google Chrome’s GPU graphics processor is related to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to cause a service failure or execute arbitrary code using a specially created malicious web page...

CVE-2021-29765

IBM PowerVM Hypervisor FW940 and FW950 could allow an attacker to obtain sensitive information if they gain service access to the FSP. IBM X-Force ID: 202476...

IBM PowerVM Hypervisor Authorization Vulnerability

IBM PowerVM Hypervisor is an application from Universal Business Machines IBM, Inc. provides a secure and scalable virtualized environment for applications built on the advanced RAS features and leading performance of the Power Systems platform. An authorization issue vulnerability exists in IBM...

CVE-2021-20505

The PowerVM Logical Partition MobilityLPM PowerVM Hypervisor FW920, FW930, FW940, and FW950 encryption key exchange protocol can be compromised. If an attacker has the ability to capture encrypted LPM network traffic and is able to gain service access to the FSP they can use this information to...

CVE-2021-20505

The PowerVM Logical Partition MobilityLPM PowerVM Hypervisor FW920, FW930, FW940, and FW950 encryption key exchange protocol can be compromised. If an attacker has the ability to capture encrypted LPM network traffic and is able to gain service access to the FSP they can use this information to...

IBM Power System security vulnerabilities

IBM Power System is a Power processor-based server computer from IBM in the United States. A security vulnerability exists in the IBM Power System that could compromise the PowerVM Logical Partition Migration LPM encryption key exchange protocol. If an attacker could exploit the vulnerability to ...

[SECURITY] [DLA 2718-1] intel-microcode security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2718-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta July 23, 2021 https://wiki.debian.org/LTS - -----------------------------------------------------------------------...

Weak password vulnerability in Huawei USG2160

Huawei USG2160 is a security gateway with 1 Wan + 8 FE interfaces and a multi-core processor. A weak password vulnerability exists in Huawei USG2160, which can be exploited by an attacker to log into the backend and obtain sensitive information...

CVE-2021-36716

A ReDoS regular expression denial of service flaw was found in the Segment is-email package before 1.0.1 for Node.js. An attacker that is able to provide crafted input to the isEmailinput function may cause an application to consume an excessive amount of CPU...

CVE-2021-0288

A vulnerability in the processing of specific MPLS packets in Juniper Networks Junos OS on MX Series and EX9200 Series devices with Trio-based MPCs Modular Port Concentrators may cause FPC to crash and lead to a Denial of Service DoS condition. Continued receipt of this packet will sustain the...

jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 inclusive, 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” i.e. q parameters, the server may enter a denial of service DoS state due to high CPU usage processing those quality...

Apple Silicon Support on Insight Agent

We are pleased to announce the general availability of native support of Apple Silicon chips for the Rapid7 Insight Agent! The Insight Agent has been fully validated and tested to run on the new Apple Silicon systems natively, and does not require Rosetta 2 to install or operate. This ensures...

Qualcomm chip buffer error vulnerability

The Qualcomm SDX55 and MSM8909 are both products of Qualcomm Incorporated.The SDX55 is a modem.The MSM8909 is a central processing unit CPU product. The qualcomm chips have a buffer error vulnerability that stems from a lack of length checking when flashing a meta-image, which could result in an...

jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 inclusive, 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” i.e. q parameters, the server may enter a denial of service DoS state due to high CPU usage processing those quality...

Debian: Security Advisory (DLA-2700-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 inclusive, 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” i.e. q parameters, the server may enter a denial of service DoS state due to high CPU usage processing those quality...

Samsung Galaxy S10 has an information leakage vulnerability

Samsung Galaxy S10 is a new generation smartphone flagship model from South Korean company Samsung with Qualcomm Snapdragon 855 processor, 6.1-inch screen and more. Samsung Galaxy S10 has an information leakage vulnerability that can be exploited by attackers to obtain sensitive information...

ckeditor4 vulnerable to cross-site scripting

A cross-site scripting XSS vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --! is mishandled...

GHSA-RGX6-RJJ4-C388 ckeditor4 vulnerable to cross-site scripting

A cross-site scripting XSS vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --! is mishandled...

ckeditor4 vulnerable to cross-site scripting

A cross-site scripting XSS vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --! is mishandled...