The vulnerability of the HTTP/2 network software decoder in HAProxy allows a attacker to cause a service failure.

The vulnerability of the HTTP/2 network software decoder in HAProxy arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to cause a service failure using a specially created package...

envoy: Resource exhaustion when proxying HTTP/2 requests or responses with small data frames

A flaw was found in Envoy in versions through 1.14.1. An excessive amount of memory may be consumed when proxying HTTP/2 requests and responses that contain many small e.g. 1 byte data frames. The highest threat from this vulnerability is to system availability...

SUSE-SU-2020:1864-1 Security update for nasm

nasm was updated to version 2.14.02: Fix crash due to multiple errors or warnings during the code generation pass if a list file is specified. Create all system-defined macros defore processing command-line given preprocessing directives -p, -d, -u, --pragma, --before. If debugging is enabled,...

We-COM Municipality portal CMS SQL Injection Vulnerability

We-COM Municipality portal CMS is a Content Management System CMS from the Italian company We-COM. A SQL injection vulnerability exists in We-COM Municipality portal CMS version 2.1.x. The vulnerability stems from a lack of validation of externally-entered SQL statements in a database-based...

We-COM OpenData CMS SQL Injection Vulnerability

We-COM OpenData CMS is a Content Management System CMS from the Italian company We-COM. A SQL injection vulnerability exists in We-COM OpenData CMS version 2.0, which arises from a lack of validation of externally entered SQL statements in database-based applications and can be exploited by an...

Zhenjiang City Yunyou Network Technology Co., Ltd. Yunyou CMS v2.0.8 exists SQL injection vulnerability

CloudYou CMS is a free + open source urban substation content management system based on TP5.0 framework as the core development. Zhenjiang City Yunyou Network Technology Co., Ltd. Yunyou CMS v2.0.8 SQL injection vulnerability, attackers can use the vulnerability to obtain database sensitive...

nghttp2: overly large SETTINGS frames can lead to DoS

A resource consumption vulnerability was found in nghttp2. This flaw allows an attacker to repeatedly construct an overly large HTTP/2 SETTINGS frame with a length of 14,400 bytes that causes excessive CPU usage, leading to a denial of service...

XSS Vulnerability in 115cms 2.0

115cms is developed with the face of the most popular current ThinkPHP framework, which is an efficient and open source content management system. 115cms 2.0 has an XSS vulnerability that can be exploited by attackers to obtain an administrator cookie...

PT-2020-14083 · Ocs Inventory · Ocs Inventory Ng

Name of the Vulnerable Software and Affected Versions: OCS Inventory NG version 2.7 Description: The issue allows for Remote Command Execution via shell metacharacters in the require/commandLine/CommandLine.php file. This is due to the mishandling of the mib file in plugins/main sections/ms...

Naviwebs Navigate CMS Authorization Issues Vulnerability

Naviwebs Navigate CMS is an open source content management system CMS from Naviwebs, Inc. in the United States. A security vulnerability exists in the password recovery feature in Naviwebs Navigate CMS version 2.9 r1433, which originates from a notfound message being returned when the user name o...

Naviwebs Navigate CMS Cross-Site Scripting Vulnerability (CNVD-2020-35980)

Naviwebs Navigate CMS is an open source content management system CMS from Naviwebs, Inc. in the United States. A cross-site scripting vulnerability exists in Naviwebs Navigate CMS version 2.9 r1433. The vulnerability stems from a lack of proper validation of client-side data by the WEB...

CVE-2020-14018

An issue was discovered in Navigate CMS 2.9 r1433. There is a stored XSS vulnerability that is executed on the page to view users, and on the page to edit users. This is present in both the User field and the E-Mail field. On the Edit user page, the XSS is only triggered via the E-Mail field;...

PYSEC-2020-95

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication spark.authenticate via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even...

Red Hat Quay Cross-Site Scripting Vulnerability

Red Hat Quay is a distributed container image repository from Red Hat, Inc. that is used to build, distribute and deploy containers. A cross-site scripting vulnerability exists in Red Hat Quay version 2. The vulnerability can be exploited by an attacker to inject and run scripts with the help of...

DEBIAN-CVE-2020-4031

In FreeRDP before version 2.1.2, there is a use-after-free in gdiSelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are affected. This is fixed in version 2.1.2...

CVE-2019-3865

A vulnerability was found in quay-2, where a stored XSS vulnerability has been found in the super user function of quay. Attackers are able to use the name field of service key to inject scripts and make it run when admin users try to change the name...

The vulnerability of the Internet Key Exchange version 2 (IKEv2) function in Cisco IOS and Cisco IOS XE operating systems allows a hacker to induce a service failure.

The vulnerability of the Internet Key Exchange version 2 IKEv2 function in Cisco IOS and Cisco IOS XE operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

BIOTRONIK CardioMessenger II-S Authorization Issue Vulnerability (CNVD-2020-52056)

The Biotronik CardioMessenger II-S is a portable medical monitoring device from Biotronik Germany. An authorization issue vulnerability exists in Biotronik CardioMessenger II-S T-Line T4APP version 2.20 and II-S GSM T4APP version 2.20, which stems from the program using the same credentials for...

HTTP/2: large amount of data requests leads to denial of service

A flaw was found in HTTP/2. An attacker can request a large amount of data by manipulating window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this queue can consume excess CPU, memory, or both, leading to a...

Zephyr Code Execution Vulnerability (CNVD-2020-35962)

Zephyr is an open source, small, scalable real-time operating system from the Linux Foundation. A security vulnerability exists in the MQTT packet length decoder in Zephyr 2.2.0 and later versions fixed in version 2.3.0. An attacker could exploit this vulnerability to cause memory corruption and...