CVE-2021-38206

A flaw was found on the Linux kernel. A NULL pointer dereference in the radiotap parser, leading to a denial of service, can occur in the mac80211 subsystem when a device supports only 5 GHz is used and frames with 802.11a rates are injected. The highest threat from this vulnerability is to syste...

wildfly-openssl: memory leak per HTTP session creation in WildFly OpenSSL

A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. This flaw allows an attacker to cause an Out of memory OOM issue, leading to a denial of service. The highest threat from this vulnerability is to system availability...

xnio: file descriptor leak caused by growing amounts of NIO Selector file handles may lead to DoS

A flaw was found in xnio. A file descriptor leak caused by growing amounts of NIO Selector file, handled between garbage collection cycles, may allow the attacker to cause a denial of service. The highest threat from this vulnerability is to system availability...

shiro: specially crafted HTTP request may cause an authentication bypass

A flaw was found in Apache shiro. When using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass. This highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

CVE-2021-38204

A flaw was found in the Linux kernel. A denial of service attack use-after-free and panic can be caused by a physically proximate attack by removing a MAX-3421 USB device in certain situations. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

CVE-2021-38202

A flaw was found in Linux kernel. A remote attacker could cause a denial of service attack by sending NFS traffic when trace event framework is being used for nfsd. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Mitigation...

CVE-2021-38201

A flaw was found in the Linux kernel that allows remote attackers to cause a denial of service xdrsetpagebase slab-out-of-bounds access by performing many NFS 4.2 READPLUS operations. The highest threat from this vulnerability is to system availability. Mitigation Mitigation for this issue is...

golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents

A flaw was found in Go, where it attempts to allocate excessive memory. This issue may cause panic or unrecoverable fatal error if passed inputs with very large exponents. The highest threat from this vulnerability is to system availability...

Debian DLA-2738-1 : c-ares - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2738 advisory. An issue has been found in c-ares, an asynchronous name resolver. Missing input validation of host names returned by Domain Name Servers can lead to output of wrong...

SUSE SLES12: kernel-azure / kernel-azure-base / kernel-azure-devel / etc (SUSE-SU-2021:2644-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2644-1 advisory. The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes. The following security bugs wer...

SUSE SLES11 Security Update : libcares2 (SUSE-SU-2021:14776-1)

The remote SUSE Linux SLES11 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2021:14776-1 advisory. - CVE-2021-3672: Fixed input validation on hostnames bsc1188881. Tenable has extracted the preceding description block directly from the SUSE security...

CVE-2021-38200

A flaw was found in the Linux kernel on the powerpc architecture, where a local user can cause a denial of service and panic the system when issuing the 'perf record' command. The highest threat from this vulnerability is to system availability. Mitigation Mitigation for this issue is either not...

CVE-2021-3672

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS Domain Name Servers can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as we...

CVE-2021-26423

An infinite loop error was found in ASP.NET when processing WebSocket frames. The exploitation of this issue can cause high CPU resource consumption. The highest threat from this vulnerability is to system availability...

libuv: out-of-bounds read in uv__idna_toascii() can lead to information disclosures or crashes

A flaw has been found in libuv. Node.js is vulnerable to out-of-bounds read in libuv's uvidnatoascii function which is used to convert strings to ASCII which is called by Node's DNS module's lookup function and can lead to information disclosures or crashes. The highest threat from this...

hw: vt-d related privilege escalation

A flaw was found in Intel® VT-d products. Entries from the context cache on some types of context cache invalidations may not be properly invalidated which may allow an authenticated user to potentially enable escalation of privilege via local access. The highest threat from this vulnerability is...

CVE-2021-3672

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS Domain Name Servers can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as we...

KLA12258 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, obtain sensitive information, gain privileges, cause denial of service. Below is a complete list of vulnerabilities: 1. A security bypass Microsoft Azure can ...

EulerOS 2.0 SP8 : postgresql (EulerOS-SA-2021-2312)

According to the version of the postgresql packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that you'...

EulerOS 2.0 SP8 : openldap (EulerOS-SA-2021-2310)

According to the versions of the openldap packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP's slapd server, to...