jenkins: Excessive memory allocation in graph URLs leads to denial of service

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit sizes provided as query parameters to graph-rendering URLs, allowing attackers to request crafted URLs that use all available memory in Jenkins, potentially leading to out of memory errors...

jenkins: Reflected XSS vulnerability in markup formatter preview

A flaw was found in jenkins. A cross-site scripting XSS vulnerability is possible due to the lack of restrictions in URL rendering in the formatted previews of markup passed as a query parameter if the configured markup formatter does not prohibit unsafe elements in the markup. The highest threat...

jenkins: Excessive memory allocation in graph URLs leads to denial of service

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit sizes provided as query parameters to graph-rendering URLs, allowing attackers to request crafted URLs that use all available memory in Jenkins, potentially leading to out of memory errors...

CVE-2021-20233

A flaw was found in grub2. Setparamprefix in the menu rendering code performs a length calculation on the assumption that expressing a quoted single quote will require 3 characters, while it actually requires 4 characters which allows an attacker to corrupt memory by one byte for each quote in th...

[SECURITY] Fedora 32 Update: webkit2gtk3-2.30.5-1.fc32

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. This package contains WebKit2 based WebKitGTK for GTK 3...

The vulnerabilities of the 3D model rendering software programs Luxion KeyShot, Luxion KeyShot Viewer, Luxion KeyShot Network Rendering, and Luxion KeyVR allow attackers to execute arbitrary code.

The vulnerability of the 3D model rendering software programs Luxion KeyShot, Luxion KeyShot Viewer, Luxion KeyShot Network Rendering, and Luxion KeyVR lies in the handling of memory buffer overflow attacks. Exploiting this vulnerability allows an attacker to execute arbitrary code during the...

The vulnerabilities of the 3D model rendering software programs Luxion KeyShot, Luxion KeyShot Viewer, Luxion KeyShot Network Rendering, and Luxion KeyVR allow attackers to execute arbitrary code.

The vulnerabilities of the 3D model rendering software programs Luxion KeyShot, Luxion KeyShot Viewer, Luxion KeyShot Network Rendering, and Luxion KeyVR are related to pointer assignment errors. Exploiting these vulnerabilities can allow attackers to execute arbitrary code...

The vulnerabilities of the 3D model rendering software programs Luxion KeyShot, Luxion KeyShot Viewer, Luxion KeyShot Network Rendering, and Luxion KeyVR allow attackers to execute arbitrary code.

The vulnerability of the 3D model rendering software programs Luxion KeyShot, Luxion KeyShot Viewer, Luxion KeyShot Network Rendering, and Luxion KeyVR lies in the reading of data beyond the buffer in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code during the...

The vulnerabilities of the 3D model rendering software programs Luxion KeyShot, Luxion KeyShot Viewer, Luxion KeyShot Network Rendering, and Luxion KeyVR allow attackers to compromise the confidentiality, integrity, and accessibility of protected information, due to incorrect path restrictions for accessing the restricted catalog.

The vulnerability of the software tools for rendering 3D models, such as Luxion KeyShot, Luxion KeyShot Viewer, Luxion KeyShot Network Rendering, and Luxion KeyVR, exists due to an incorrect limitation on the path to the restricted-access catalog. Exploiting this vulnerability can allow attackers...

@shoplo/kit-vue (>=1.17.0, <=1.22.16), dm-cli (>=0.4.1-0, <=0.4.5) potentially affected by CVE-2021-23342 via docsify (>=4.2.1, <=4.9.1)

docsify NPM version =4.2.1, =1.17.0, =0.4.1-0, =0.4.5 Source cves: CVE-2021-23342 Source advisory: OSV:GHSA-2MM9-C2FX-C7M4...

Splash has a denial of service vulnerability

Splash is a JavaScript rendering service, a lightweight browser with an HTTP API, and it interfaces with the Twisted and QT libraries in Python. A denial of service vulnerability exists in Splash. An attacker can exploit this vulnerability to cause the program to crash...

Saltstack SaltStack Salt 代码注入漏洞

SaltStack Salt is a set of open source tools for managing infrastructure from SaltStack Saltstack. The tool provides configuration management, remote execution, and other features. A code injection vulnerability exists in SaltStack Salt versions prior to Salt 3002.5 that stems from a failure of t...

February 24, 2021—KB4601382 (OS Builds 19041.844 and 19042.844) Preview

None None...

CVE-2021-22651

When loading a specially crafted file, Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 are, while processing the extraction of temporary files, suffering from a...

Directory traversal

When loading a specially crafted file, Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 are, while processing the extraction of temporary files, suffering from a...

CVE-2021-22645

Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 are vulnerable to an attack because the .bip documents display a “load” command, which can be pointed to a .dll fro...

CVE-2021-22645

Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 are vulnerable to an attack because the .bip documents display a “load” command, which can be pointed to a .dll fro...

CVE-2021-22649

Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 have multiple NULL pointer dereference issues while processing project files, which may allow an attacker to execut...

CVE-2021-22647

CVE-2021-22647 affects Luxion KeyShot family: KeyShot, KeyShot Viewer, KeyShot Network Rendering, and KeyVR versions prior to 10.1. The vulnerability is described as multiple out-of-bounds write issues encountered while processing project files, which may allow an attacker to execute arbitrary co...

CVE-2021-22643

CVE-2021-22643 affects Luxion KeyShot family: KeyShot, KeyShot Viewer, KeyShot Network Rendering, and KeyVR prior to version 10.1. The vulnerability is an out-of-bounds read while processing project files, which may allow arbitrary code execution. Red Hat’s entry corroborates the same affected pr...