Neo4j 路径遍历漏洞

Neo4j is a Java-based and fully ACID-compatible graphical database from Neo4j, Inc. that supports data migration, add-ons, and more. A security vulnerability exists in Neo4j APOC Awesome Procedures on Cypher version 4.3.0.7, version 4.x up to and including 4.4.0.8, which stems from allowing...

This Week in Spring - August 1st, 2022

Aloha, Spring fans! Welcome to another installment of This Week in Spring! Im still on vacation on the beautiful island of Maui, Hawaii, but I wanted to say hello "aloha!" and share this weeks latest roundup of all thats good and glorious in the wide and wonderful world of Springdom. Funny thing,...

[SECURITY] Fedora 36 Update: commit-stream-0.1.2-8.fc36

OSINT tool for finding Github repositories by extracting commit logs in real time from the Github event API...

DEBIAN-CVE-2021-33453

An issue was discovered in lrzip version 0.641. There is a use-after-free in ucompthread in stream.c:1538...

CVE-2021-33453

An issue was discovered in lrzip version 0.641. There is a use-after-free in ucompthread in stream.c:1538...

DEBIAN-CVE-2022-34503

QPDF v8.4.2 was discovered to contain a heap buffer overflow via the function QPDF::processXRefStream. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted PDF file...

DEBIAN-CVE-2022-31144

Redis is an in-memory database that persists on disk. A specially crafted XAUTOCLAIM command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. This problem affects versions on the 7.x branch prior to 7.0.4. The patch is released in version...

UBUNTU-CVE-2022-31144

Redis is an in-memory database that persists on disk. A specially crafted XAUTOCLAIM command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. This problem affects versions on the 7.x branch prior to 7.0.4. The patch is released in version...

PT-2022-3806

Name of the Vulnerable Software and Affected Versions: Redis versions 7.0.0 through 7.0.3 Description: The issue is related to a heap overflow that can potentially lead to remote code execution. This occurs when a specially crafted XAUTOCLAIM command is executed on a stream key in a specific stat...

Fedora: Security Advisory for commit-stream (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

redis -- Potential remote code execution vulnerability

The Redis core team reports: A specially crafted XAUTOCLAIM command on a stream key in a specific state may result with heap overflow, and potentially remote code execution...

[SECURITY] Fedora 35 Update: commit-stream-0.1.2-7.fc35

OSINT tool for finding Github repositories by extracting commit logs in real time from the Github event API...

FFmpeg rpza_decode_stream() Code Execution Vulnerability

FFmpeg is a complete solution for recording, converting and streaming audio and video from the Ffmpeg team. A code execution vulnerability exists in FFmpeg rpzadecodestream, which can be exploited by an attacker to trigger an out-of-bounds read memory access and execute arbitrary code on the syst...

GHSA-WRCR-X4QJ-J543 KubeEdge Cloud Stream and Edge Stream DoS from large stream message

Impact The Cloud Stream server and the Edge Stream server reads the entire message into memory without imposing a limit on the size of this message. An attacker can exploit this by sending a large message to exhaust memory and cause a DoS. The Cloud Stream server and the Edge Stream server are...

CVE-2022-31079

KubeEdge CVE-2022-31079 causes a DoS by allowing a large message to be read into memory by the Cloud Stream and Edge Stream servers. Affects versions prior to 1.11.1, 1.10.2, and 1.9.4 when cloudStream (cloudcore.yaml) and edgeStream (edgecore.yaml) modules are enabled; authenticated users can tr...

CVE-2022-31079 KubeEdge Cloud Stream and Edge Stream DoS from large stream message

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the Cloud Stream server and the Edge Stream server reads the entire message into memory without imposing a limit on the size o...

KubeEdge 资源管理错误漏洞

KubeEdge is KubeEdge open source a Kubernetes native edge computing framework. Built on Kubernetes and extends native containerized application orchestration and device management to edge hosts. A security vulnerability exists in KubeEdge versions prior to 1.11.1, 1.10.2, and 1.9.4. The...

PT-2022-20514 · Kubeedge · Kubeedge

Name of the Vulnerable Software and Affected Versions: KubeEdge versions prior to 1.11.1 KubeEdge versions prior to 1.10.2 KubeEdge versions prior to 1.9.4 Description: The Cloud Stream server and the Edge Stream server read the entire message into memory without imposing a limit on the size of...

XStream: remote command execution attack by manipulating the processed input stream

A flaw was found in XStream. By manipulating the processed input stream, a remote attacker may be able to obtain sufficient rights to execute commands. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Fedora: Security Advisory for golang-github-francoispqt-gojay (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...