Grok Buffer Overflow Vulnerability

Grok is a regular expression that uses a combination of multiple predefined . A tool used to match split text and map to keywords. Often used to preprocess log data. A security vulnerability exists in Grok versions 7.6.6 through 9.2.0 that stems from a heap-based buffer overflow in the...

LibreSSL 缓冲区错误漏洞

LibreSSL is an open source implementation of the Secure Sockets Layer and Transport Layer security protocols. A security vulnerability exists in LibreSSL that stems from LibreSSL 2.9.1 through 3.2.1 having an out-of-bounds read in asn1itemprintctx called from asn1templateprintctx. No details of t...

Apache Traffic Server 环境问题漏洞

Apache Traffic Server or ATS or TS for short , is a high-performance , modular HTTP proxy and caching server . A security vulnerability exists in Apache Traffic Server versions 7.0.0 - 7.1.12, 8.0.0 - 8.1.1, 9.0.0 - 9.0.1. An attacker can exploit this vulnerability to smuggle requests via invalid...

Istio 权限许可和访问控制问题漏洞

Istio is a set of open platforms for connecting, managing, and securing microservices. Istio is vulnerable to a privilege permission and access control issue that arises from an application that does not properly impose security restrictions. This vulnerability could allow an attacker to access...

Avaya Aura Device Services 代码注入漏洞

Avaya Aura Device Services is a software application from Avaya, USA. It provides a feature for managing Avaya endpoints. A security vulnerability exists in Avaya Aura Device Services versions 7.0 through 8.1.4.0, which can be exploited by local users to execute specially written scripts...

CVE-2021-25652

An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Appliance Virtualization Platform Utilities AVPU. This vulnerability may potentially allow any local user to access system functionality and configuration information that should only be...

DEBIAN-CVE-2021-29063

A Regular Expression Denial of Service ReDOS vulnerability was discovered in Mpmath v1.0.0 through v1.2.1 when the mpmathify function is called...

CVE-2021-29063

A Regular Expression Denial of Service ReDOS vulnerability was discovered in Mpmath v1.0.0 through v1.2.1 when the mpmathify function is called...

@apollosproject/data-connector-passes (>=0.8.7 <=1.7.1-alpha.8) potentially affected by CVE-2021-32691 via @apollosproject/data-connector-rock (>=0.8.7 <=1.8.0)

@apollosproject/data-connector-rock NPM version =0.8.7, =0.8.7, =1.7.1-alpha.8 Source cves: CVE-2021-32691 Source advisory: OSV:GHSA-R578-PJ6F-R4FF...

CVE-2021-29059

A vulnerability was discovered in IS-SVG version 2.1.0 to 4.2.2 and below where a Regular Expression Denial of Service ReDOS occurs if the application is provided and checks a crafted invalid SVG string...

Joomla 授权问题漏洞

Joomla is an open source, cross-platform content management system CMS developed using PHP and MySQL by the Open Source Matters team. A security vulnerability exists in Joomla! Core versions 1.5.0 through 1.5.15, which can be exploited by attackers to hijack arbitrary sessions and gain access to...

ckeditor4 vulnerable to cross-site scripting

A cross-site scripting XSS vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --! is mishandled...

wagtail-resume (=1.3.0), wagtail-social-share (>=0.0.6 <=0.1.1) potentially affected by CVE-2021-32681 via wagtail (>=2.12.0 <=2.12.2)

wagtail PYPI version =2.12.0, =0.0.6, =0.1.1 Source cves: CVE-2021-32681 Source advisory: OSV:PYSEC-2021-103...

@generates/cli (>=0.0.2 <=0.0.7), @generates/core (>=0.0.2 <=0.0.7) +40 more potentially affected by CVE-2021-23397 via @ianwalter/merge (>=1.0.2 <=9.0.1)

@ianwalter/merge NPM version =1.0.2, =0.0.2, =0.0.2, =0.0.40, =0.0.2, =0.0.2, =0.0.0, =0.0.1, =2.5.0, =1.0.0, =3.0.0, =2.0.0, =1.1.1, =0.0.1, =0.1.1, =1.0.0 and more Source cves: CVE-2021-23397 Source advisory: SNYK:JS-IANWALTERMERGE-1311022...

ai.stainless:grails-tika (=0.1.0), au.com.turingg:turingg-files (=0.0.1) +1719 more potentially affected by CVE-2021-27807 via org.apache.pdfbox:pdfbox (>=2.0.0 <=2.0.22)

org.apache.pdfbox:pdfbox MAVEN version =2.0.0, =0.2.1, =0.5.0, =0.11.1, =1.0.0, =1.0, =1.3.5, =0.1.8, =1.1.7 - cc.drx:pdf2.13 =ee - cc.drx:poi2.13 =ee and more Source cves: CVE-2021-27807 Source advisory: OSV:GHSA-2H3J-M7GR-25XJ...

CVE-2020-5000

IBM Financial Transaction Manager 3.2.0 through 3.2.8 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Forc...

expand-hash 安全漏洞

expand-hash is a package. Attribute keys can be expanded recursively into objects using dot notation. A security vulnerability exists in expand-hash versions 0.1.0 through 1.0.1 that results in a denial of service and can lead to remote code execution...

UBUNTU-CVE-2021-33829

A cross-site scripting XSS vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --! is mishandled...

PT-2021-4279

Name of the Vulnerable Software and Affected Versions CKEditor 4 versions 4.14.0 through 4.16.x Description A cross-site scripting XSS vulnerability in the HTML Data Processor allows remote attackers to inject executable JavaScript code through a crafted comment because --! is mishandled. This...

RaspAP 安全漏洞

RaspAP is a simple wireless AP setup and management for Debian-based devices. A security vulnerability exists in RaspAP, which stems from multiple elevation of privilege vulnerabilities in RaspAP from version 1.5 to 2.6.5 that could allow a remote, authenticated attacker to inject arbitrary...