XStream: SSRF via crafted input stream

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on...

GHSA-Q4HM-FWC9-HMV6 Insecure temporary file used in com.squareup:connect

This affects all versions of package com.squareup:connect. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file...

Improper Verification of Cryptographic Signature in aws-encryption-sdk-java

Impact This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This update addresses an issue where certain invalid ECDSA signatures incorrectly passed validation. These signatures provide defense in depth...

PT-2021-18253 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy versions 1.18.2 and earlier Description: Envoy does not decode escaped slash sequences %2F and %5C in HTTP URL paths. A remote attacker may craft a path with escaped slashes, e.g. /something%2F..%2Fadmin, to bypass access control, e.g. ...

GHSA-4MF2-F3WH-GVF2 Subdomain checking of whitelisted domains could allow unintended redirects in oauth2-proxy

Impact What kind of vulnerability is it? Who is impacted? For users that use the whitelist domain feature, a domain that ended in a similar way to the intended domain could have been allowed as a redirect. For example, if a whitelist domain was configured for .example.com, the intention is that...

Predictable SIF UUID Identifiers in github.com/sylabs/sif

Impact The siftool new command and func siftool.New produce predictable UUID identifiers due to insecure randomness in the version of the github.com/satori/go.uuid module used as a dependency. Patches A patch is available in version = v1.2.3 of the module. Users are encouraged to upgrade. The pat...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read. A heap buffer overflow read was discovered in upx 4.0.0, because the check in plxelf.cpp is not perfect. Remediation Upgrade upx to version 4.2.1 or higher. References - GitHub Commit - GitHub Issue...

PT-2021-18326 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2 and earlier TensorFlow versions 2.3.3 and earlier TensorFlow versions 2.2.3 and earlier TensorFlow versions 2.1.4 and earlier Description: The implementation of tf.raw...

Adobe InDesign < 16.2.1 Multiple Vulnerabilities (APSB21-22)

The version of Adobe InDesign installed on the remote Windows host is prior or equal to 16.2.1. It is, therefore, affected by multiple out-of-bounds write vulnerabilities that could lead to code execution in the context of the current user. Note that Nessus has not attempted to exploit these issu...

PYSEC-2021-47

Pydantic is a data validation and settings management using Python type hinting. In affected versions passing either 'infinity', 'inf' or float'inf' or their negatives to datetime or date fields causes validation to run forever with 100% CPU usage on one CPU. Pydantic has been patched with fixes...

CVE-2021-29511

evm is a pure Rust implementation of Ethereum Virtual Machine. Prior to the patch, when executing specific EVM opcodes related to memory operations that use evmcore::Memory::copylarge, the evm crate can over-allocate memory when it is not needed, making it possible for an attacker to perform...

UBUNTU-CVE-2021-29499

SIF is an open source implementation of the Singularity Container Image Format. The siftool new command and func siftool.New produce predictable UUID identifiers due to insecure randomness in the version of the github.com/satori/go.uuid module used as a dependency. A patch is available in version...

PT-2021-3910 · Eventlet +3 · Eventlet +3

Name of the Vulnerable Software and Affected Versions: Eventlet versions prior to 0.31.0 Description: The issue is related to the handling of large websocket frames in the Eventlet library, which can lead to memory exhaustion. A malicious peer can exploit this by sending highly compressed data...

PT-2021-18254 · Unknown · Kennnyshiwa-Cogs

Name of the Vulnerable Software and Affected Versions: kennnyshiwa-cogs versions prior to 5a84d60018468e5c0346f7ee74b2b4650a6dade7 Description: A remote code execution RCE exploit has been found in the Tickets module of kennnyshiwa-cogs, allowing Discord users to craft a message that can reveal...

PYSEC-2021-4

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions 1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fi...

Security Bulletin: Security vulnerabilities in Apache Tomcat affects multiple IBM Rational products based on IBM's Jazz technology

Summary The Jazz Team Server is shipped with or supports versions of the Apache Tomcat web server which contain security vulnerabilities that could potentially impact the following IBM Rational products deployed on Apache Tomcat: Collaborative Lifecycle Management CLM, Rational DOORS Next...

Moderate: Red Hat Enhancement Advisory: rh-eclipse bug fix and enhancement update

Updated rh-eclipse packages are now available as a part of Red Hat Developer Tools for Red Hat Enterprise Linux. Eclipse is an integrated development environment IDE. The rh-eclipse packages have been upgraded to version 4.19, which is based on the Eclipse Foundation's 2021-03 release train. For...

PT-2021-2895 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.23 and prior Description: The issue is related to insufficient input validation in the MySQL Server product, specifically in the Server: DML component. This allows a high-privileged attacker with network access via...

GHSA-RVCW-F68W-8H8H Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime

Impact AESCBCHMACSHA2 Algorithm A128CBC-HS256, A192CBC-HS384, A256CBC-HS512 decryption would always execute both HMAC tag verification and CBC decryption, if either failed JWEDecryptionFailed would be thrown. But a possibly observable difference in timing when padding error would occur while...