Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

log4j-CVE-2021-44228-workaround A. Solution Description =====...

Multiple vulnerabilities in multiple Yamaha routers

Overview Multiple routers provided by Yamaha Corporation contain multiple vulnerabilities listed below. Cross-site script inclusion CWE-829 - CVE-2021-20843 Improper neutralization of HTTP request headers for scripting syntax CWE-644 - CVE-2021-20844 Shoji Baba of IERAE SECURITY INC. reported the...

CVE-2021-43853

Ajax.NET Professional AjaxPro is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation...

CVE-2021-43853

Ajax.NET Professional AjaxPro is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation...

CVE-2021-43853

Ajax.NET Professional AjaxPro is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation...

CVE-2021-43853 Cross-Site Scripting in AjaxNetProfessional

Ajax.NET Professional AjaxPro is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation...

PT-2021-7106 · Unknown · Ajax.Net Professional

Name of the Vulnerable Software and Affected Versions: Ajax.NET Professional AjaxPro versions prior to 21.12.22.1 Description: The issue relates to JavaScript object injection, which may result in cross-site scripting when leveraged by a malicious user. This occurs due to the deserialization of...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Ajax.Releases are affected. A workaround exists that replaces one of the core JavaScript files embedded in the library. See the GHSA-5q7q-qqw2-hjq7 for workaround details...

PT-2021-24221 · Gpac · Gpac

Name of the Vulnerable Software and Affected Versions: gpac version 1.1.0 Description: An invalid memory address dereference issue exists via the svg node start function, causing a segmentation fault and application crash. Recommendations: For gpac version 1.1.0, consider disabling the svg node...

PT-2021-7259

Name of the Vulnerable Software and Affected Versions FreePBX versions 15.0.19.87 through 15.0.19.88 FreePBX versions 16.0.18.40 through 16.0.18.41 Description The issue allows remote attackers to execute arbitrary code. This has been exploited in the wild, with reports of attacks starting in...

Security Bulletin: Vulnerability in Apache Log4j (CVE-2021-44228) impacts IBM Watson Machine Learning Accelerator

Summary Log4j is used by IBM Watson Machine Learning Accelerator for generating logs in some of its components. This bulletin provides mitigations for the Log4j vulnerability CVE-2021-44228 by applying workaround steps to IBM Watson Machine Learning Accelerator. Vulnerability Details Refer to the...

PT-2021-24170 · Gnuplot +2 · Gnuplot +2

Name of the Vulnerable Software and Affected Versions: gnuplot version 5.4 Description: A Divide by Zero issue exists in the boundary3d function in graph3d.c, which could cause an Arithmetic exception and application crash. Recommendations: For gnuplot version 5.4, consider disabling the boundary...

PT-2021-24228 · Gpac · Gpac

Name of the Vulnerable Software and Affected Versions: Gpac version 1.0.1 Description: An infinite loop issue exists in the gf get bit size function of Gpac. Recommendations: For Gpac version 1.0.1, consider disabling the gf get bit size function as a temporary workaround until a patch is...

GHSA-G54H-M393-CPWQ devices resource list treated as a blacklist by default

Impact Contrary to the OCI runtime specification, runc's implementation of the linux.resources.devices list was a black-list by default. This means that users who created their own config.json objects and didn't prefix a deny-all rule "allow": false, "permissions": "rwm" or equivalent were not...

Open redirect vulnerability in Sourcegraph

Impact An open redirect vulnerability that allows users to be targeted for phishing attacks has been found in Sourcegraph instances configured with OAuth, OpenID, or SAML authentication enabled. Users targeted by these phishing attacks could have their authentication tokens silently harvested by ...

GHSA-68WM-PFJF-WQP6 Authelia vulnerable to an authentication bypassed with malformed request URI on nginx

Impact This affects uses who are using nginx ngxhttpauthrequestmodule with Authelia, it allows a malicious individual who crafts a malformed HTTP request to bypass the authentication mechanism. It additionally could theoretically affect other proxy servers, but all of the ones we officially suppo...

Authelia vulnerable to an authentication bypassed with malformed request URI on nginx

Impact This affects uses who are using nginx ngxhttpauthrequestmodule with Authelia, it allows a malicious individual who crafts a malformed HTTP request to bypass the authentication mechanism. It additionally could theoretically affect other proxy servers, but all of the ones we officially suppo...

Improper Authentication

Authelia is a a single sign-on multi-factor portal for web apps. This affects uses who are using nginx ngxhttpauthrequestmodule with Authelia, it allows a malicious individual who crafts a malformed HTTP request to bypass the authentication mechanism. It additionally could theoretically affect...

PT-2022-5003 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.35.5 MediaWiki versions 1.36.x prior to 1.36.3 MediaWiki versions 1.37.x prior to 1.37.1 Description: An issue was discovered in the REST API of MediaWiki, which publicly caches results from private wikis,...

GHSA-XMGJ-5FH3-XJMM Path traversal when MessageBus::Diagnostics is enabled

Impact Users who deployed message bus with diagnostics features enabled default off were vulnerable to a path traversal bug, which could lead to disclosure of secret information on a machine if an unintended user were to gain access to the diagnostic route. The impact is also greater if there is ...