Cross-Site Request Forgery (CSRF) in collectiveaccess/providence

Description I have found more endpoints which allow edit/duplicate were not protected from CSRF, the following endpoints are: 1: Edit Global Value in Pawtucket. 2: Change object type. 3: Duplicate object. 4: Duplicate items in the set and add to another set. Proof of Concept Via GET requests: 1...

EulerOS 2.0 SP8 : systemd (EulerOS-SA-2021-2487)

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value involving strdupa an...

Unpatched Apple Zero-Day Allows Code Execution

A zero-day security vulnerability in Apple’s macOS Finder system could allow remote attackers to trick users into running arbitrary commands, according to researchers – and a silent patch hasn’t fixed it. For those not in the Apple camp, the macOS Finder is the default file manager and GUI...

Use safeTransfer instead of transfer

Handle hack3r-0m Vulnerability details transfer might return false instead of reverting, in this case, ignoring return value leads to considering it successful. use safeTransfer or check the return value if length of returned data is 0. --- The text was updated successfully, but these errors were...

PT-2021-23077 · Http4S · Http4S

Name of the Vulnerable Software and Affected Versions: http4s versions prior to 0.21.30 http4s versions prior to 0.22.5 http4s versions prior to 0.23.4 http4s versions prior to 1.0.0-M27 Description: http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input...

CVE-2021-39538

An issue was discovered in pdftools through 20200714. A NULL pointer dereference exists in the function node::ObjNode::Value located in objnode.cpp. It allows an attacker to cause Denial of Service...

The vulnerability of the ext_get_plugin() function in the syntax analyzer and data modeling tool of YANG Libyang, related to an unvalidated return value, allows a malicious actor to trigger a service failure.

The vulnerability of the extgetplugin function in the syntax analyzer and data modeling tool of the YANG Libyang language is related to the lack of checking for a NULL revision. Exploiting this vulnerability could allow an attacker to cause service failures...

The vulnerability of the read_yin_leaf() function in the syntax analyzer and tools of the YANG data modeling language Libyang, related to an unvalidated return value, allows attackers to trigger service failures.

The vulnerability of the readyinleaf function in the syntax analyzer and data modeling tool of the YANG Libyang language is related to the lack of checking for NULL values in retval-extr. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Pdftools 代码问题漏洞

PDFTools is a tool for converting PDF files to ePUB format. node::ObjNode::Value function in objnode.cpp in PDFTools 20200714 and earlier versions is vulnerable to null pointer dereference. An attacker could exploit this vulnerability to cause a denial of service...

The vulnerability of the WAF engine for Apache ModSecurity, related to deficiencies in handling exceptional states, allows a attacker to trigger a service failure.

The vulnerability of the WAF engine for Apache ModSecurity is related to incorrect data processing in the form of key-value pairs. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service interruptions...

OSV-2021-1317 Use-of-uninitialized-value in std::__1::basic_ostream<char, std::__1::char_traits<char> >& std::__1::__put_cha

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38824 Crash type: Use-of-uninitialized-value Crash state: std::1::basicostream & std::1::putcha ostream std::1::basicostream & std::1::putcha...

OSV-2021-1312 Use-of-uninitialized-value in std::__1::basic_ostream<char, std::__1::char_traits<char> >& std::__1::__put_cha

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38808 Crash type: Use-of-uninitialized-value Crash state: std::1::basicostream & std::1::putcha printjson fuzzdump.cpp...

OSV-2021-1305 Use-of-uninitialized-value in std::__1::basic_ostream<char, std::__1::char_traits<char> >& std::__1::__put_cha

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38831 Crash type: Use-of-uninitialized-value Crash state: std::1::basicostream & std::1::putcha S2LatLng::ToPoint s2textformat::ParsePoints...

OSV-2021-1301 Use-of-uninitialized-value in std::__1::__hash_iterator<std::__1::__hash_node<std::__1::__hash_value_type<std:

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38823 Crash type: Use-of-uninitialized-value Crash state: std::1::hashiteratorstd::1::hashnodestd::1::hashvaluetypestd: opencensus::tags::TagKeyRegistry::Register opencensus::tags::TagKey::Register...

OSV-2021-1287 Use-of-uninitialized-value in piex::image_type_recognition::ContainsNikonSignatures

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38799 Crash type: Use-of-uninitialized-value Crash state: piex::imagetyperecognition::ContainsNikonSignatures piex::imagetyperecognition::NefTypeChecker::IsMyType piex::imagetyperecognition::RecognizeRawImageTypeLite...

OSV-2021-1275 Use-of-uninitialized-value in std::__1::basic_ostream<char, std::__1::char_traits<char> >& std::__1::__put_cha

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38785 Crash type: Use-of-uninitialized-value Crash state: std::1::basicostream & std::1::putcha S2LogMessage::S2LogMessage S2ContainsVertexQuery::ContainsSign...

OSV-2021-1269 Use-of-uninitialized-value in std::__1::basic_ostream<char, std::__1::char_traits<char> >& std::__1::__put_cha

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38777 Crash type: Use-of-uninitialized-value Crash state: std::1::basicostream & std::1::putcha S2LaxPolylineShape::Init S2LaxPolylineShape::S2LaxPolylineShape...

CVE-2021-23440

A type confusion vulnerability in nodejs-set-value can lead to a bypass of CVE-2019-10747. If the user-provided keys used in the path parameter are arrays, the function mixin-deep can be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or...

RUSTSEC-2021-0111 Memory Safety Issue when using `patch` or `merge` on `state` and assign the result back to `state`

Affected versions of this crate maintains references to memory that might have been freed already. If affects the following two tremor-script language constructs: A Merge where we assign the result back to the target expression and the expression to be merged needs to reference the event: let sta...

Moderate: Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (etcd) security update

An update for etcd is now available for Red Hat OpenStack Platform 16.2 Train. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...