PT-2021-29034

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.12.9 Description The issue is related to the use of smp processor id in preemptible code within the SCSI target core. The actual impact and potential for attack have not been proven yet. Recommendations For...

UVI-2021-1000416 ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook

ARM: 9064/1: hwbreakpoint: Do not directly check the event's overflowhandler hook This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.120 by...

ALPINE-CVE-2021-20201

A flaw was found in spice in versions before 0.14.92. A DoS tool might make it easier for remote attackers to cause a denial of service CPU consumption by performing many renegotiations within a single connection...

Apache Fineract security vulnerabilities

Apache Fineract is a set of open source digital financial services platform from the U.S. Apache Apache Foundation. The platform can provide users with data management, loan and savings portfolio management and real-time financial data and other functions. A security vulnerability exists in Apach...

cmake:xml_parser_fuzzer: Use-of-uninitialized-value in lookup

Detailed Report: https://oss-fuzz.com/testcase?key=6079026075664384 Project: cmake Fuzzing Engine: libFuzzer Fuzz Target: xmlparserfuzzer Job Type: libfuzzermsancmake Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: lookup prologProcessor prologInitProcessor...

com.sap.cloud.adk:adapter.api (>=2.26.0, <=2.33.0), com.sap.cloud.script:script.api (>=2.14.0, <=2.15.0) +766 more potentially affected by CVE-2020-11971 via org.apache.camel:camel-core (2.24.2)

org.apache.camel:camel-core MAVEN version 2.24.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-core and may be impacted: - com.sap.cloud.adk:adapter.api =2.26.0, =2.14.0, =1.2.0-rc1, =1.1.4-rc1, =1.1.4-rc1, =1.1.4-rc1,...

com.github.oscerd:camel-cassandra (2.23.0), com.playtika.sleuth:sleuth-camel-core (1.0.2) +664 more potentially affected by CVE-2020-11971 via org.apache.camel:camel-core (2.23.0)

org.apache.camel:camel-core MAVEN version 2.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-core and may be impacted: - com.github.oscerd:camel-cassandra 2.23.0 - com.playtika.sleuth:sleuth-camel-core 1.0.2 -...

PT-2021-28267

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash caused by an unknown read. The crash occurs in the Json::decodePrefixedString function, which is called by...

PT-2024-11225

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.13.0-rc1+ 34 Description A vulnerability has been resolved in the Linux kernel, specifically in the scsi: target: core, where the function smp processor id was called in preemptible code, triggering a BUG...

perfetto:trace_processor_fuzzer: Crash in Json::decodePrefixedString

Project: https://android.googlesource.com/platform/external/perfetto/ Detailed Report: https://oss-fuzz.com/testcase?key=4546621204463616 Project: perfetto Fuzzing Engine: libFuzzer Fuzz Target: traceprocessorfuzzer Job Type: libfuzzerasanperfetto Platform Id: linux Crash Type: UNKNOWN READ Crash...

Ubuntu: Security Advisory (USN-4628-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

About the security content of Boot Camp 6.1.14

About the security content of Boot Camp 6.1.14 This document describes the security content of Boot Camp 6.1.14. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

CVE-2021-32920

Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests...

jetty: Resource exhaustion when receiving an invalid large TLS frame

When using SSL/TLS with Jetty, either with HTTP/1.1, HTTP/2, or WebSocket, the server may receive an invalid large greater than 17408 TLS frame that is incorrectly handled, causing high CPU resources utilization. The highest threat from this vulnerability is to service availability...

Pydantic security vulnerabilities

pydantic is a software application. Data validation and settings management using Python type hints. A security vulnerability exists in Pydantic. The vulnerability stems from the fact that the program's validation will always run at 100% CPU usage...

AMD Secure Encrypted Virtualization

Bulletin ID: AMD-SB-1004 Potential Impact: Arbitrary Code Execution Severity: Medium Summary AMD is aware of 2 research papers related to AMD’s Secure Encrypted Virtualization SEV which will be presented at this year’s 15th IEEE Workshop on Offensive Technologies WOOT’21. In the paper titled...

2019.2 IPU – Intel® Processor Machine Check Error Advisory

Summary: A potential security vulnerability in some Intel® Processors may allow denial of service. Intel has coordinated with OS and hypervisor vendors to provide updates which will mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2018-12207 Description: Improper...

GHSA-VCJF-MGCG-JXJQ CKEditor 4.0 vulnerability in the HTML Data Processor

A cross-site scripting XSS vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14.0 allows remote attackers to inject arbitrary web script through a crafted "protected" comment with the ckeprotected syntax...

CKEditor 4.0 vulnerability in the HTML Data Processor

A cross-site scripting XSS vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14.0 allows remote attackers to inject arbitrary web script through a crafted "protected" comment with the ckeprotected syntax...

CKEditor 4.0 vulnerability in the HTML Data Processor

A cross-site scripting XSS vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14.0 allows remote attackers to inject arbitrary web script through a crafted "protected" comment with the ckeprotected syntax...