10390 matches found
RawSpeed 缓冲区错误漏洞
RawSpeed is a full-line solution for Internet users to upload and download large files. A buffer overflow vulnerability exists in RawSpeed, which stems from an out-of-bounds read/write operation occurring due to a failure to validate memory boundaries during a call to the TableLookUp::setTable...
CVE-2021-21005
In Phoenix Contact FL SWITCH SMCS series products in multiple versions if an attacker sends a hand-crafted TCP-Packet with the Urgent-Flag set and the Urgent-Pointer set to 0, the network stack will crash. The device needs to be rebooted afterwards...
CVE-2021-23398
All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting XSS via the dataFormat parameter. The problem is triggered when an invalid React element is returned, leading to dangerouslySetInnerHTML being used, which does not sanitize the output...
Cross site scripting
An issue was discovered in JFinal framework v4.9.10 and below. The "set" method of the "Controller" class of jfinal framework is not strictly filtered, which will lead to XSS vulnerabilities in some cases...
CVE-2021-24000
A race condition with requestPointerLock and setTimeout could have resulted in a user interacting with one tab when they believed they were on a separate tab. In conjunction with certain elements such as input type="file" this could have led to an attack where a user was confused about the origin...
JFinal 跨站脚本漏洞
JFinal is a Java language based WEB + ORM open source framework. JFinal JFinal has a security vulnerability that stems from the set method of the Controller class in Jfinal version v4.9.10 and below is not strictly filtered , which can lead to XSS vulnerability in some cases...
Linux-PAM 安全漏洞
Linux-pam is a pluggable-supported system authentication software for Linux from the Linux-pam team. A security vulnerability exists in Linux-PAM that allows a local attacker to exploit the vulnerability to set quotas on arbitrary filesystems, in some cases the home directory of the attacker to...
Prototype Pollution
Overview Prototype pollution vulnerability in ‘set-getter’ version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution. Recommendation Upgrade to version 0.1.1 or later References - CVE - GitHub Advisory...
SerenityOS 缓冲区错误漏洞
SerenityOS is a graphical Unix-like operating system for x86 computers. A stack buffer overflow vulnerability exists in the setrange test in TestBitmap in SerenityOS. An attacker can exploit this vulnerability to obtain sensitive information...
Prototype Pollution
Overview merge-change is a Deep merge of objects and other types, also for patches and immutable updates. Affected versions of this package are vulnerable to Prototype Pollution via the utils.set function. Details Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution...
Denial Of Service (DoS)
Mutt is vulnerable to denial of service. An out-of-bounds read in imap/util.c where an IMAP sequence set ends with a comma could result in disclosure of confidential information or an application crash...
Deposits can be denied by abusing maxContractBalance
Handle cmichel Vulnerability details Vulnerability Details The treasury implements a max contract balance check in the deposit function: require erc20.balanceOfaddressthis + amount This is not only restricted to whales, miners/users can do the same using same-block cross-transaction flashloans an...
Unbreakable Enterprise kernel-container security update
4.14.35-2047.504.2.el7 - md/raid1: properly indicate failure when ending a failed write request Paul Clements Orabug: 32887159 - video: hypervfb: Add ratelimit on error message Michael Kelley Orabug: 32856879 - Drivers: hv: vmbus: Initialize unloadevent statically Andrea Parri Microsoft Orabug:...
Unbreakable Enterprise kernel security update
5.4.17-2102.202.5 - sctp: delay autoasconf init until binding the first addr Xin Long Orabug: 32907967 CVE-2021-23133 CVE-2021-23133 - dm ioctl: fix out of bounds array access when no devices Mikulas Patocka Orabug: 32860491 CVE-2021-31916 - uek-rpm: update kABI lists for the new symbols Saeed...
Insecure TLS Configuration
libcurl.so uses an insecure TLS configuration. The selected cipher set was stored in a single "static" variable in the library, and due to an error in code, the last cipher that is set would control the set used by all transfers...
OESA-2021-1221 redis security update
Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets. Security Fixes: Redis is an open source BSD licensed, in-memory data structure store, used as a database, cache, and message broker. An integer...
CVE-2021-25949
Prototype pollution vulnerability in 'set-getter' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution...
CVE-2021-25949
Prototype pollution vulnerability in 'set-getter' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution...
