Moderate: Red Hat Security Advisory: Red Hat OpenShift Container Storage 4.8.5 Security and Bug Fix Update

An update is now available for Red Hat OpenShift Container Storage 4.8.5 on Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...

CISA Releases Capacity Enhancement Guides to Enhance Mobile Device Cybersecurity for Consumers and Organizations

CISA has released actionable Capacity Enhancement Guides CEGs to help users and organizations improve mobile device cybersecurity. The CEG: Mobile Device Cybersecurity Checklist for Consumers provides steps for consumers, including using strong authentication and enabling automatic operating syst...

xstream: Server-side request forgery (SSRF) via unsafe deserialization of jdk.nashorn.internal.runtime.Source$URLData

A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to request data from internal resources that are not publicly available by manipulating the processed input stream with Java runtime versions 14 to 8. The highest thre...

xstream: Server-side request forgery (SSRF) via unsafe deserialization of com.sun.xml.internal.ws.client.sei.*

A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to request data from internal resources that are not publicly available by manipulating the processed input stream with Java runtime versions 14 to 8. The highest thre...

XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is...

pcs security update

0.10.10-4.0.1 - Replace HAM-logo.png with a generic one 0.10.10-4 - Fixed unfencing in - Resolves: rhbzbz1991654 0.10.10-3 - Added add/remove syntax for command - Resolves: rhbz1992668 0.10.10-2 - Fixed create resources with depth operation attribute - Resolves: rhbz1998454 0.10.10-1 - Rebased to...

in tsolucio/corebos

Description There's no bound limit to the number of characters/special characters in "Add Module - Window Title" Add window -- Modules. javascript:chooseType'Module';fnRemoveWindow;setFilterdocument.getElementById'selmoduleid' Steps to reproduce Step 1. Goto -...

CVE-2021-26329

AMD System Management Unit SMU may experience an integer overflow when an invalid length is provided which may result in a potential loss of resources...

Improper access control

Improper access controls in System Management Unit SMU may allow for an attacker to override performance control tables located in DRAM resulting in a potential lack of system resources...

Integer overflow

AMD System Management Unit SMU may experience an integer overflow when an invalid length is provided which may result in a potential loss of resources...

CVE-2021-26338

The CVE targets AMD's System Management Unit (SMU) in AMD EPYC processors (1st–3rd Gen) where improper access controls may allow an attacker to override DRAM performance-control tables, risking resource exhaustion. Affected components/versions are stated in AMD’s bulletin AMD-SB-1021 (AGESA mitig...

CVE-2021-26338

Improper access controls in System Management Unit SMU may allow for an attacker to override performance control tables located in DRAM resulting in a potential lack of system resources...

PT-2021-17015 · Unknown · Amd System Management Unit

Name of the Vulnerable Software and Affected Versions: System Management Unit SMU affected versions not specified Description: The issue is related to improper access controls in the System Management Unit SMU, which may allow an attacker to override performance control tables located in DRAM. Th...

BusyBox 资源管理错误漏洞

BusyBox is a set of applications containing several linux commands and tools by Denis Vlasenko, a Ukrainian personal developer. Busybox suffers from a Resource Management Error vulnerability that arises from mismanagement of system resources e.g., memory, disk space, files, etc. by a networked...

The vulnerability of the Web page rendering module in WebKit operating systems of the Mac OS family allows attackers to access protected information.

The vulnerability of the Web page rendering module in WebKit operating systems of the Mac OS family relates to the ability to execute tasks in parallel using a shared resource. Exploiting this vulnerability can allow an attacker to gain access to protected information...

BusyBox Resource Management Error Vulnerability (CNVD-2021-88213)

BusyBox is a set of applications containing several linux commands and tools by Denis Vlasenko, a Ukrainian personal developer. Busybox suffers from a Resource Management Error vulnerability that arises from mismanagement of system resources e.g., memory, disk space, files, etc. by a networked...

CVE-2021-26558 Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability of Apache ShardingSphere-UI allows an attacker to inject outer link resources. This issue affects Apache ShardingSphere-UI Apache ShardingSphere-UI version 4.1.1 and later versions; Apache ShardingSphere-UI versions prior to 5.0.0...

in cortezaproject/corteza-server

Description Hey, when I attempt to change the password after creating an account I noticed that you haven't kept any password boundary. You need to limit password length. Hashing a large amount of data can cause significant resource consumption on behalf of the server and would be an easy target...

GHSA-GPFH-JVF9-7WG5 Use after free / memory leak in `CollectiveReduceV2`

Impact The async implementation of CollectiveReduceV2 suffers from a memory leak and a use after free: python import tensorflow as tf tf.rawops.CollectiveReduceV2 input=, groupsize=-10, -10, -10, groupkey=-10, -10, instancekey=-10, orderingtoken=, mergeop='Mul', finalop='Div' This occurs due to t...

Improper privilege management in Keycloak

A flaw was found in Keycloak, where it would permit a user with a view-profile role to manage the resources in the new account console. This flaw allows a user with a view-profile role to access and modify data for which the user does not have adequate permission...