jenkins: Excessive memory allocation in graph URLs leads to denial of service

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit sizes provided as query parameters to graph-rendering URLs, allowing attackers to request crafted URLs that use all available memory in Jenkins, potentially leading to out of memory errors...

February 16, 2021-KB4601383 (OS Build 17763.1790) Preview

None None...

February 16, 2021—KB4601380 (OS Build 18363.1411) Preview

None None...

The vulnerability of the backdrop-filter function in the WebKit CSS module for rendering web pages allows a hacker to induce a service failure through a specially crafted HTML page.

The vulnerability of the backdrop-filter function in the WebKit CSS rendering component is related to the high resource consumption required for processing div elements. Exploiting this vulnerability can allow a remote attacker to cause a service failure through a specially crafted HTML page...

Cross-site Scripting (XSS)

roundcube is vulnerable to cross-site scripting XSS. The vulnerability exists through specific CSS token sequences during HTML email rendering which allows an attacker to inject and execute arbitrary javascript...

CVE-2021-26925

Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets CSS token sequences during HTML email rendering...

CVE-2021-26925

Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets CSS token sequences during HTML email rendering...

CVE-2021-26925

Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets CSS token sequences during HTML email rendering...

Design/Logic Flaw

Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets CSS token sequences during HTML email rendering...

CVE-2021-26925

Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets CSS token sequences during HTML email rendering...

CVE-2021-26925

CVE-2021-26925 affects Roundcube Webmail prior to 1.4.11, enabling cross-site scripting via crafted CSS token sequences while rendering HTML emails. Public advisories (Mageia/Fedora) confirm the fix in 1.4.11. Remediate by upgrading Roundcube to 1.4.11 or newer; exploitation status is not describ...

PT-2021-17180 · Roundcube +1 · Roundcube +1

Name of the Vulnerable Software and Affected Versions: Roundcube versions prior to 1.4.11 Description: The issue allows for an XSS attack through crafted Cascading Style Sheets CSS token sequences during the rendering of HTML email. This can occur when an attacker sends a specially designed email...

CVE-2021-21610

A flaw was found in jenkins. A cross-site scripting XSS vulnerability is possible due to the lack of restrictions in URL rendering in the formatted previews of markup passed as a query parameter if the configured markup formatter does not prohibit unsafe elements in the markup. The highest threat...

Luxion KeyShot Buffer Error Vulnerability

Luxion KeyShot is a software for designing photos of 3D scenes from Luxion USA. The software enables a real-time 3D rendering workflow that displays results immediately and reduces the time required to create photorealistic product photos. A buffer error vulnerability exists in Luxion KeyShot...

Uroboros - A GNU/Linux Monitoring And Profiling Tool Focused On Single Processes

Uroboros is a GNU/Linux monitoring tool focused on single processes. While utilities like top, ps and htop provide great overall details, they often lack useful temporal representation for specific processes, such visual representation of the process data points can be used to profile, debug and...

Qt WebEngine: Multiple vulnerabilities

Background Library for rendering dynamic web content in Qt5 C++ and QML applications. Description Multiple vulnerabilities have been discovered in Qt WebEngine. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

@byhuz/huz-ui-sigma (>=1.0.19, <=1.0.27), @deliverybot/client (>=0.7.0, <=0.7.2) +30 more potentially affected by CVE-2021-23327 via apexcharts (>=3.2.0, <=3.23.1)

apexcharts NPM version =3.2.0, =1.0.19, =0.7.0, =0.0.2, =0.0.2, =0.0.2, =0.0.2, =7.20.0-snapshot-1617172219791, =2.3.0, =1.0.3, =0.0.1, =0.0.1, =0.0.1, =1.1.0, =1.15.0 and more Source cves: CVE-2021-23327 Source advisory: SNYK:JS-APEXCHARTS-1062708...

CVE-2021-25175

An issue was discovered in Open Design Alliance Drawings SDK before 2021.11. A Type Conversion issue exists when rendering malformed .DXF and .DWG files. This can allow attackers to cause a crash, potentially enabling a denial of service attack Crash, Exit, or Restart...

Denial Of Service (DoS)

jenkins is vulnerable to denial of service DoS. The vulnerability exists as it does not limit sizes provided as query parameters to graph-rendering URLs...

Cross-site Scripting (XSS)

jenkins is vulnerable to cross-site scripting XSS. The vulnerability exists as it does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query parameter...