Memory corruption

Possible memory corruption and information leakage in sub-system due to lack of check for validity and boundary compliance for parameters that are read from shared MSG RAM in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdrag...

CVE-2020-11204

CVE-2020-11204 affects Qualcomm closed‑source components within Snapdragon Auto/Compute/Connectivity/IoT families. The root cause is a lack of validation and boundary checks for parameters read from shared MSG RAM in multiple sub-systems, causing potential memory corruption and information leakag...

CVE-2020-29031

An Insecure Direct Object Reference vulnerability exists in the web UI of the GateManager which allows an authenticated attacker to reset the password of any user in its domain or any sub-domain, via escalation of privileges. This issue affects all GateManager versions prior to 9.2c...

USN-4732-1: SQLite vulnerability

It was discovered that SQLite incorrectly handled certain sub-queries. An attacker could use this issue to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code...

Privilege Escalation

sqlite3 is vulnerable to privilege escalation. The vulnerability exists through a problem during handling sub-queries with both a correlated WHERE clause and a HAVING 0 clause where the parent query is itself an aggregate...

CVE-2021-20228

A flaw was found in the Ansible Engine, where sensitive info is not masked by default and is not protected by the nolog feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. The highest threat from this vulnerability is to...

Regular Expression Denial of Service

The ReDOS vulnerability of the regex is mainly due to the sub-pattern a-zA-Z0-9.-+.a-zA-Z0-9.-+ This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory...

CVE-2021-3178

A flaw leak of the file handle for parent directory in the Linux kernel's NFS3 functionality was found in the way user calls READDIRPLUS. A local user could use this flaw to traverse to other parts of the file-system than mounted sub-folder. Mitigation When export subdirectory of a filesystem,...

PT-2021-27600

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of UNKNOWN READ, with details provided in a crash state. The crash involves boost::sub match and boost::match result...

PT-2021-27484

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of Use-of-uninitialized-value. The crash state involves functions such as bn sub words, bn reduce once, and bn from...

PT-2021-5504

Name of the Vulnerable Software and Affected Versions D-Link DIR-809 devices with firmware through DIR-809Ax FW1.12WWB03 20190410 Description A stack buffer overflow issue was found in the sub 80046EB4 function in the /formSetPortTr endpoint. This issue can be triggered via a crafted POST request...

CVE-2020-35579

tindy2013 subconverter 0.6.4 has a /sub?target=%TARGET%&url=%URL%&config=%CONFIG% API endpoint that accepts an arbitrary %URL% value and launches a GET request for it, but does not consider that the external request target may indirectly redirect back to this original /sub endpoint. Thus, a reque...

PT-2020-17350

Name of the Vulnerable Software and Affected Versions tindy2013 subconverter version 0.6.4 Description The issue concerns a /sub?target=%TARGET%&url=%URL%&config=%CONFIG% API endpoint that accepts an arbitrary %URL% value and launches a GET request for it. However, it does not account for the...

PT-2020-19828

Name of the Vulnerable Software and Affected Versions Infraware ML Report version 2.19.312.0000 Description An issue was discovered in the ML Report Program, where a stack-based buffer overflow occurs in the function sub 41EAF0 at MLReportDeamon.exe. This happens because the function calls vsprin...

Information disclosure

An information leak vulnerability exists in Gerrit versions prior to 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where a missing access check on the branch REST API allows an attacker with only the default set of priviledges to read all other user's personal account data as well as sub-trees with...

Nanopb Buffer Error Vulnerability

Nanopb is a protocol buffer implementation for microprocessors by the individual developers of Nanopb. A buffer error vulnerability exists in Nanopb version 0.4.4 and versions prior to 0.3.9.7, which stems from the possibility that a decoded message in a particular format may leak memory if dynam...

bind: incorrect enforcement of update-policy rules of type "subdomain"

A flaw was found in bind. Updates to "Update-policy" rules of type "subdomain" are treated as if they were of type "zonesub" which allows updates to all parts of the zone along with the intended subdomain. The highest threat from this vulnerability is to data integrity...

Garud - An Automation Tool That Scans Sub-Domains, Sub-Domain Takeover And Then Filters Out XSS, SSTI, SSRF And More Injection Point Parameters

An automation tool that scans sub-domains, sub-domain takeover and then filters out xss, ssti, ssrf and more injection point parameters. Requirements: Go Language, Python 2.7 or Python 3. System requirements: Recommended to run on vps with 1VCPU and 2GB ram. Tools used - You must need to install...

JetBrains YouTrack 信息泄露漏洞

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. An access control error vulnerability exists in JetBrains YouTrack versions prior to...

idm:DL1 and idm:client security, bug fix, and enhancement update

bind-dyndb-ldap 11.3-1 - New upstream release - Resolves: rhbz1845211 ipa 4.8.7-12.0.1 - Set IPAPLATFORM=rhel when build on Oracle Linux Orabug: 29516674 4.8.7-12 - Require selinux sub package in the proper version Related: RHBZ1868432 - SELinux: do not double-define nodet and pkitomcatcertt...