Archive
2 June 2021
Vulnerabilities first published on this day (UTC), newest first.
78 results · Feed
-
Unscored —
A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection …
-
Medium 5.5
GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.
-
Unscored —
A flaw was discovered in GNU libiberty within demangle_path() in rust-demangle.c, as distributed in GNU Binutils versio…
-
Medium 5.5
Pillow denial of service
An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.
-
Critical 9.8
Prototype pollution in Merge-deep
The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks ag…
-
Unscored —
The ahci_commit_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service (NULL dereference) whe…
-
Unscored —
lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the func…
-
Low —
Temporary urls leaked via logging
In OpenStack Swift through 2.10.1, 2.11.0 through 2.13.0, and 2.14.0, the proxy-server logs full tempurl paths, potentially leaking reusable tempurl signatures to anyone with read access to these logs. All Swift deployments using the tempurl middleware are af…
-
Unscored —
An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions…
-
Unscored —
An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versi…
-
Unscored —
Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and incl…
-
Critical 9.8
go.uuid has Predictable UUID Identifiers
A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7daf2b8e1d60c45. Due to insecure randomness in the g.rand.Read function the generated UUIDs are predictable for an attac…
-
Unscored —
A NULL pointer dereference flaw was found in the megasas-gen2 SCSI host bus adapter emulation of QEMU in versions befor…
-
High 7.5
Uncontrolled Resource Consumption in jboss-remoting
A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client reque…
-
Unscored —
An insecure modification flaw in the /etc/kubernetes/kubeconfig file was found in OpenShift. This flaw allows an attack…
-
Low 3.2
Cleartext Transmission of Sensitive Information in McAfee DBSec
Cleartext Transmission of Sensitive Information vulnerability in the administrator interface of McAfee Database Security (DBSec) prior to 4.8.2 allows an administrator to view the unencrypted password of the McAfee Insights Server used to pass data to the Ins…
-
Critical 9.0
Authorized deserialization of untrusted data in McAfee DBSec
Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote authenticated attacker to create a reverse shell with administrator privileges on the DBSec server via carefully constructed Java serialized obj…
-
Critical 9.6
Unauthorized deserialization of untrusted data in McAfee DBSec
Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote unauthenticated attacker to create a reverse shell with administrator privileges on the DBSec server via carefully constructed Java serialized o…
-
Medium 6.5
An improper following of a certificate's chain of trust vulnerability in FortiGate versions 6.4.0 to 6.4.4 may allow an…
-
Unscored —
A flaw was found in the Red Hat 3scale API Management Platform, where member permissions for an API's admin portal were…
-
Unscored —
There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger …
-
Unscored —
An account takeover flaw was found in Red Hat Satellite 6.7.2 onward. A potential attacker with proper authentication t…
-
Unscored —
A credential leak vulnerability was found in Red Hat Satellite. This flaw exposes the compute resources credentials thr…
-
Medium 5.9
Uncontrolled Resource Consumption in XNIO
A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It may allow the attacker to cause a denial of service. It affects XNIO versions 3.6.0.Beta1 through 3.…
-
Unscored —
A flaw was found in Red Hat Satellite, which allows a privileged attacker to read OMAPI secrets through the ISC DHCP of…
-
Unscored —
A flaw was found in the Restricted Security Context Constraints (SCC), where it allows pods to craft custom network pac…
-
Unscored —
It was found that the issue for security flaw CVE-2019-3805 appeared again in a further version of JBoss Enterprise App…
-
High 7.5
RESTEasy 4.5.5.Final in hash flooding
A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding, leading to slower requests with higher CPU time spent searching and adding the entry. This flaw allows an attacker to cause a denial of servi…
-
Unscored —
A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects…
-
Unscored —
It was discovered that OpenShift Container Platform's (OCP) distribution of Kibana could open in an iframe, which made …
-
Unscored —
A flaw was found in the Linux kernel. An index buffer overflow during Direct IO write leading to the NFS client to cras…
-
Medium 4.3
Two authorization bypass through user-controlled key vulnerabilities in the Fortinet FortiPresence 2.1.0 administration…
-
Critical 9.8
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail compone…
-
High 7.2
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in …
-
High 7.7
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management compone…
-
High 7.5
Potential infinite loop in Pillow
An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.
-
Unscored —
KDE Messagelib through 5.17.0 reveals cleartext of encrypted messages in some situations. Deleting an attachment of a d…
-
Unscored —
aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.