The vulnerability of the ptp4l software service, which is used to implement the PTP protocol for LinuxPTP, allows a malicious actor to cause an unexpected termination of the application.

The vulnerability of the ptp4l software service for implementing the LinuxPTP timing protocol is due to an operation going beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to cause an application to terminate abnormally by creating a one-step...

Nextcloud server authorization issue vulnerability (CNVD-2021-102886)

Nextcloud server is an open source self-hosted file synchronization and sharing communication application platform from Nextcloud Germany. nextcloud server is vulnerable to authorization issues in versions prior to 20.0.12, 21.0.4 or 22.1.0. The vulnerability stems from a lack of authentication...

Nextcloud Circles Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in Nextcloud Circles, an open source, self-hosted file synchronization and sharing communication application platform from Nextcloud Germany, which stems from the failure of the product's Content-Security-Policy to properly handle incoming input data in...

Mozilla Rust Memory Corruption Vulnerability (CNVD-2021-71659)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. rust mayqueue crate through 2020-11-10 A security vulnerability exists due to a limitation in the queue's lack of send feature or synchronization feature, which could be exploited by an attacker to cause a memor...

Mozilla Rust Memory Corruption Vulnerability (CNVD-2021-71657)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in Rust hashconsing crate before 1.1.0, which stems from a limitation in HConsed's lack of sending or synchronization features, and could be exploited by an attacker to cause a...

CVE-2021-22004: Concurrent Execution using Shared Resource with Improper Synchronization

An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a malicious actor to subvert the proper behaviour of the given minion software...

CVE-2021-28701: Concurrent Execution using Shared Resource with Improper Synchronization

Another race in XENMAPSPACEgranttable handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches back from v2...

Security Bulletin: IBM Security Identity Manager Password Synchronization Plug-in for Windows AD affected by multiple vulnerabilities (CVE-2021-20483, CVE-2021-20488)

Summary IBM has announced a release for IBM Security Identity Manager Password Synchronization Plug-in for Windows AD to address several security vulnerabilities. The vulnerabilities concern server side request forgery and account take over. Vulnerability Details CVEID: CVE-2021-20483 DESCRIPTION...

CVE-2021-39260

A crafted NTFS image can cause an out-of-bounds access in ntfsinodesyncstandardinformation in NTFS-3G 2021.8.22...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a microkernel-based, fully distributed operating system. Huawei HarmonyOS has a security vulnerability that could be exploited by attackers to isolate and read synchronization files from other applications via UID sandboxing...

The vulnerability of Mozilla Maintenance Service allows attackers to escalate their privileges on Firefox ESR and Firefox browsers.

The vulnerability of the Mozilla Maintenance Service affects Firefox ESR and Firefox browsers due to synchronization errors when using a common resource. Exploiting this vulnerability can allow attackers to increase their privileges...

CVE-2021-28697: Concurrent Execution using Shared Resource with Improper Synchronization

grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, get de-allocated when a guest...

Improper Synchronization and Race Condition in vm-memory

rust-vmm vm-memory before 0.1.1 and 0.2.x before 0.2.1 allows attackers to cause a denial of service loss of IP networking because readobj and writeobj do not properly access memory. This affects aarch64 with musl or glibc and x8664 with musl...

GHSA-MM4M-QG48-F7WC Improper Synchronization and Race Condition in vm-memory

rust-vmm vm-memory before 0.1.1 and 0.2.x before 0.2.1 allows attackers to cause a denial of service loss of IP networking because readobj and writeobj do not properly access memory. This affects aarch64 with musl or glibc and x8664 with musl...

Data races in unicycle

Affected versions of this crate unconditionally implemented Send & Sync for types PinSlab & Unordered. This allows sending non-Send types to other threads and concurrently accessing non-Sync types from multiple threads. This can result in a data race & memory corruption when types that provide...

Data races in unicycle

Affected versions of this crate unconditionally implemented Send & Sync for types PinSlab & Unordered. This allows sending non-Send types to other threads and concurrently accessing non-Sync types from multiple threads. This can result in a data race & memory corruption when types that provide...

Improper synchronization in buttplug

An issue was discovered in the buttplug crate before 1.0.4 for Rust. ButtplugFutureStateShared does not properly consider !Send|!Sync objects, leading to a data race...

GHSA-R7RV-2RPH-HVHJ Improper synchronization in buttplug

An issue was discovered in the buttplug crate before 1.0.4 for Rust. ButtplugFutureStateShared does not properly consider !Send|!Sync objects, leading to a data race...

Data race in atomic-option

An issue was discovered in the atomic-option crate through 2020-10-31 for Rust. Because AtomicOption implements Sync unconditionally, a data race can occur...

Improper Input Validation in renderdoc

Affected versions of this crate exposed several methods which took self by immutable reference, despite the requesting the RenderDoc API to set a mutable value internally. This is technically unsound and calling these methods from multiple threads without synchronization could lead to unexpected...