Zulip 安全漏洞

Zulip server is an open source team chat application from the American company Zulip. A security vulnerability exists in Zulip Server versions prior to 3.4 that stems from a public API that causes guest users to be able to receive message traffic from a public stream that should only be accessibl...

CVE-2021-22999

On versions 15.0.x before 15.1.0 and 14.1.x before 14.1.4, the BIG-IP system provides an option to connect HTTP/2 clients to HTTP/1.x servers. When a client is slow to accept responses and it closes a connection prematurely, the BIG-IP system may indefinitely retain some streams unclosed. Note:...

CVE-2021-22999

On versions 15.0.x before 15.1.0 and 14.1.x before 14.1.4, the BIG-IP system provides an option to connect HTTP/2 clients to HTTP/1.x servers. When a client is slow to accept responses and it closes a connection prematurely, the BIG-IP system may indefinitely retain some streams unclosed. Note:...

GHSA-HVV8-336G-RX3M A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

Impact The processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a...

XStream 代码问题漏洞

XStream is a simple Java-based library , Java objects serialized to xml and vice versa i.e. : Java objects and xml documents can easily be converted to each other . XStream code execution vulnerability , an attacker can be exploited to manipulate the processed input stream and replace or inject...

XStream 代码问题漏洞

XStream is a simple Java-based library , Java objects serialized to xml and vice versa i.e. : Java objects and xml documents can easily be converted to each other . XStream has a server-side request forgery vulnerability that can be exploited by an attacker to manipulate the processed input strea...

USN-4853-1 liblivemedia vulnerabilities

It was discovered that liveMedia incorrectly handled certain network packets. An attacker could possibly use this issue to execute arbitrary code. CVE-2018-4013 It was discovered that liveMedia incorrectly handled certain network sessions. An attacker could possibly use this issue to cause a deni...

Server-Side Request Forgery (SSRF)

xstream is vulnerable to Server-Side Forgery Request. The processed stream at unmarshalling time contains information to recreate the formerly written objects, allowing an attacker to manipulate data streams referencing a resource in an intranet or the local host...

The vulnerability of the vfs_streams_depot or vfs_streams_xattr functions in the Samba networking communication package allows a hacker to gain access to confidential data and compromise its integrity.

The vulnerability of the vfsstreamsdepot or vfsstreamsxattr functions in Samba networking applications is related to the lack of mechanisms for privilege control and access management. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromise its...

Security Bulletin: Streams Flows might be affected by some underlying Node.js vulnerabilities

Summary Streams Flows might be affected by some underlying Node.js vulnerabilities. Vulnerability Details CVEID: CVE-2020-8277 DESCRIPTION: Node.js is vulnerable to a denial of service. By getting the application to resolve a DNS record with a larger number of responses, an attacker could exploit...

Netty 环境问题漏洞

Netty is a non-blocking I/O client-server framework from the Netty community that is primarily used to develop Java web applications such as protocol servers and clients. Netty suffers from an environmental issue vulnerability that stems from requests being converted to HTTP 1.1 objects when pass...

FreeBSD : jasper -- multiple vulnerabilities (3a469cbc-7a66-11eb-bd3f-08002728f74c)

JasPer Releases : - Fix memory-related bugs in the JPEG-2000 codec resulting from attempting to decode invalid code streams. 264, 265 This fix is associated with CVE-2021-26926 and CVE-2021-26927. - Fix wrong return value under some compilers 260 - Fix CVE-2021-3272 heap buffer overflow in...

Experts Find a Way to Learn What You're Typing During Video Calls

A new attack framework aims to infer keystrokes typed by a target user at the opposite end of a video conference call by simply leveraging the video feed to correlate observable body movements to the text being typed. The research was undertaken by Mohd Sabra, and Murtuza Jadliwala from the...

tomcat: Apache Tomcat HTTP/2 Request mix-up

A flaw was found in Apache Tomcat. If an HTTP/2 client exceeded the agreed maximum number of concurrent streams for a connection in violation of the HTTP/2 protocol, it is possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - fro...

Heap overflow

A heap overflow vulnerability exists in the way the GIF parser decodes LZW compressed streams in Accusoft ImageGear 19.8. A specially crafted malformed file can trigger a heap overflow, which can result in arbitrary code execution. An attacker can provide a malicious file to trigger this...

CVE-2020-13572

CVE-2020-13572 describes a heap overflow in the GIF LZW decoder used by Accusoft ImageGear 19.8. The vulnerability occurs while decoding LZW streams in the GIF parser, where a destination index can overflow the allocated heap buffer, potentially allowing arbitrary code execution when processing s...

The vulnerability in the interface for supporting streaming audio and video data through the Media Capture and Streams API of the Mozilla Firefox browser allows attackers to perform cross-site scripting attacks.

The vulnerability of the Media Capture and Streams API for handling streaming audio and video data in the Mozilla Firefox browser is related to a request error from documents with URL addresses “data:” or “blob:”. Exploiting this vulnerability could allow an attacker to perform cross-site scripti...

CentOS 8 : git (CESA-2019:4356)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:4356 advisory. - git: Arbitrary path overwriting via export-marks in-stream command feature CVE-2019-1348 - git: Recursive submodule cloning allows using git director...

Security Bulletin: IBM Event Streams affected by multiple Java SE security vulnerabilities

Summary IBM Event Streams is affected by multiple Java SE vulnerabilities. All Java components have been updated to deploy on the latest IBM SDK Vulnerability Details CVEID: CVE-2020-14792 DESCRIPTION: An unspecified vulnerability in Java SE related to the Hotspot component could allow an...

Security Bulletin: A vulnerability exists in the Event Streams 10.0.0 schema registry that allows unauthorised access to create, edit and delete schemas (CVE-2020-4662)

Summary A vulnerability exists in the Event Streams 10.0.0 schema registry that allows unauthorised access to create, edit and delete schemas Vulnerability Details CVEID: CVE-2020-4662 DESCRIPTION: IBM Event Streams could allow an authenticated user to perform tasks to a schema due to improper...