Apache Struts < 2.5.31 / 6.1.2.1 Denial of Service (S2-064)

The version of Apache Struts installed on the remote host is prior to 2.5.31 or 6.1.2.1. It is, therefore, affected by a vulnerability as referenced in the S2-064 advisory. - When a Multipart request has non-file normal form fields, Struts used to bring them into memory as Strings without checkin...

Hackers Win $105,000 for Reporting Critical Security Flaws in Sonos One Speakers

Multiple security flaws uncovered in Sonos One wireless speakers could be potentially exploited to achieve information disclosure and remote code execution, the Zero Day Initiative ZDI said in a report published last week. The vulnerabilities were demonstrated by three different teams from Qrious...

Juniper Networks Junos OS 安全漏洞

Juniper Networks Junos OS is a Juniper Networks network operating system for the company's hardware devices. The operating system provides a secure programming interface and the Junos SDK. A security vulnerability exists in Juniper Networks Junos OS on JRR200 that arises from improper inspection ...

ZERO TRUNCATION COULD LEAD TO UNEXPECTED RESULTS

Lines of code Vulnerability details Impact Precision issue leading to zero truncation due to numerator smaller than denominator in a ratio or a division happens readily in Solidity if extra cares have not been given to it. Arithmetic operations running into this incident are typically associated...

K12542008: Apache Struts vulnerabilities CVE-2017-9793 and CVE-2017-9804

Security Advisory Description CVE-2017-9793 The REST Plugin in Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload. CVE-2017-9804 In Apache Stru...

SUSE CVE-2021-22222

Infinite loop in DVB-S2-BB dissector in Wireshark 3.4.0 to 3.4.5 allows denial of service via packet injection or crafted capture file...

Vulnerability of the SNC_io parser function <EW>::read_sedge() and seh->sprev() in the Nef_S2/SNC_io parser.h component. This component is part of the Computational Geometry Algorithms Library CGAL, allowing an intruder to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the SNCio parser function ::readsedge in the NefS2/SNCio parser component, as part of the CGAL computational geometry algorithm library, is related to unvalidated array indexing. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise...

Vulnerability of the SM_io parser function: Decorator_.::read_vertex(), set_face() in the component Nef_S2/SM_io parser.h, part of the Computational Geometry Algorithms library CGAL. This allows an attacker to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the SMio parser function in the NefS2/SMioparser.h component, belonging to the Computational Geometry Algorithms library, is related to unvalidated array indexing. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity,...

Vulnerability of the SNC_io parser function <EW>: read_facet(), incident_volume(). Component: Nef_S2/SNC_io parser.h library, algorithm library for computational geometry CGAL. This allows an intruder to access confidential data, compromise its integrity, and cause service interruptions.

The vulnerability of the SNCio parser function ::readfacet and fh-incidentvolume in the NefS2/SNCio parser component’s NefS2/SNCio parser.h file is related to unvalidated array indexing. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity...

Vulnerability of the SNC_io parser function <EW>::read_edge(), eh->twin() in the Nef_S2/SNC_io parser.h component of the Computational Geometry Algorithms library. This vulnerability allows an attacker to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the SNCioparser function involves the use of unvalidated array indexing. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures through a specially created file. This vulnerability is related ...

Vulnerability of SNC_io parser<EW>: read_vertex(); vh->sfaces_last(); component Nef_S2/SNC_io parser.h library of computational geometry algorithms CGAL, allowing a perpetrator to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of SNCioparser is related to unvalidated array indexing. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures through a specially created file. This vulnerability is associated with the...

Vulnerability of the SM_io parser function: Decorator_::read_vertex(), set_first_out_edge() – components from Nef_S2/SM_io parser.h; library of computational geometry algorithms CGAL. This allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the SMio parser function in the decorator::readvertex and setfirstoutedge components of the NefS2/SMio parser library, part of the Computational Geometry Library CGAL, is related to unvalidated array indexing. Exploiting this vulnerability allows an attacker to gain access to...

PT-2023-1061 · Juniper Networks · Junos

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 19.3R3-S7 Junos OS versions 19.4 prior to 19.4R3-S9 Junos OS versions 20.2 prior to 20.2R3-S5 Junos OS versions 20.3 prior to 20.3R3-S5 Junos OS versions 20.4 prior to 20.4R3-S4 Junos OS versions 21.1 prior to...

CVE-2022-22220 Junos OS and Junos OS Evolved: Due to a race condition the rpd process can crash upon receipt of a BGP update message containing flow spec route

A Time-of-check Time-of-use TOCTOU Race Condition vulnerability in Routing Protocol Daemon rpd of Juniper Networks Junos OS, Junos OS Evolved allows a network-based unauthenticated attacker to cause a Denial of Service DoS. When a BGP flow route with redirect IP extended community is received, an...

Exploit for Expression Language Injection in Apache Struts

CVE-2021-31805 1. Introduction Struts2 Remote Command Exec...

GHSA-X5FC-PGPX-59J5 Server side object manipulation in Apache Struts

OGNL provides, among other features, extensive expression evaluation capabilities. This vulnerability allows a malicious user to bypass the ''-usage protection built into the ParametersInterceptor, thus being able to manipulate server side context objects. This behavior was already addressed in...

Server side object manipulation in Apache Struts

OGNL provides, among other features, extensive expression evaluation capabilities. This vulnerability allows a malicious user to bypass the ''-usage protection built into the ParametersInterceptor, thus being able to manipulate server side context objects. This behavior was already addressed in...

Apache Struts Security Update (S2-062) - Active Check

Apache Struts is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apache Struts forced OGNL evaluation incomplete fix

Added: 04/26/2022 Background Apache Struts is an open-source web application framework for developing Java EE web applications. It uses and extends the Java Servlet API to encourage developers to adopt a model-view-controller MVC architecture. Struts uses Object-Graph Navigation Language OGNL to...

DEBIAN-CVE-2020-28634

Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any o...