A directory traversal vulnerability exists in Kyocera Printer d-COPIA253MF plus. Successful exploitation of this vulnerability could allow an attacker to retrieve or view arbitrary files from the affected server.


A Directory Traversal vulnerability exists in FusionPBX 4.5.7 allows malicoius users to rename any file of the system.via the (1) folder (2) filename and (3) newfilename variables in app\\edit\\filerename.php.

directory traversal vulnerability
directory traversal


A directory traversal vulnerability in the component system/manager/class/web/database.php was discovered in Baijiacms V4 which allows attackers to arbitrarily delete folders on the server via the \id\ parameter.


A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php.


A directory traversal vulnerability in the Markdown engine of Gotenberg through 6.2.1 allows an attacker to read any container files.


A Directory Traversal vulnerability in FileReceiveServlet in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to upload a malicious file in a section of the file system where it can be executed.


A Directory Traversal vulnerability in CliMonitorReportServlet in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to read arbitrary files including files with sensitive user information.


A Directory Traversal vulnerability in servlet SoftwareImageUpload in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to write to arbitrary files and consequently delete the files.


Encoded directory traversal vulnerability in phpPgAdmin 3.1 to 3.5.3 allows remote attackers to access arbitrary files via \%2e%2e%2f\ (encoded dot dot) sequences in the formLanguage parameter.


Encoded directory traversal vulnerability in Dino's web server 2.1 allows remote attackers to read arbitrary files via \..\ (dot dot) sequences with URL-encoded (1) \/\ (%2f\) or (2) \\\\ (%5c) characters.


A directory traversal vulnerability in file upload function of Gotenberg through 6.2.1 allows an attacker to upload and overwrite any writable files outside the intended folder. This can lead to DoS a change to program behavior or code execution.

directory traversal vulnerability
directory traversal
dos


A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure.

directory traversal vulnerability
information disclosure
directory traversal


A directory traversal vulnerability in HPE Intelligent Management Center (IMC) PLAT 7.3 E0504P02 could allow remote code execution.

directory traversal vulnerability
remote code execution
directory traversal


Directory traversal vulnerability in the collect script in Splunk before 5.0.5 allows remote attackers to execute arbitrary commands via a .. (dot dot) in the file parameter. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2013-7394 is for the issue in the \runshellscript echo.sh\ script.

directory traversal
arbitrary command execution


Directory traversal vulnerability in processImageSave.jsp in DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to write arbitrary files via the chartid parameter aka Bug IDs CSCue77035 and CSCue77036. NOTE: this can be leveraged to execute arbitrary commands by using the JBoss autodeploy functionality.


Directory traversal vulnerability in Pico Server (pServ) 3.3 allows remote attackers to read arbitrary files and execute arbitrary commands via a /./ (slash dot slash) before each .. (dot dot) sequence in the URL which results in an incorrect directory depth count.


Directory traversal vulnerability in help.php in the eskuel module in KwsPHP 1.3.456 as available before 20080416 allows remote attackers to execute arbitrary commands via the action parameter. NOTE: some of these details are obtained from third party information.


Directory traversal vulnerability in the LaunchProcess function in the LaunchHelp.HelpLauncher.1 ActiveX control in LaunchHelp.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2 10.3 and 11 SP1 allows remote attackers to execute arbitrary commands via a pathname in the first argument.


Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and \\\\ characters twice.


Directory traversal vulnerability in cgi-bin/rftest.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to execute arbitrary commands via a .. (dot dot) in the ATE_COMMAND parameter.


Directory traversal vulnerability in Funsoft Dino's Webserver 1.2 and earlier allows remote attackers to read files or execute arbitrary commands via a .. (dot dot) in the URL.


Directory traversal vulnerability in the CGIServlet for Jetty HTTP server before 4.1.0 allows remote attackers to execute arbitrary commands via ..\\ (dot-dot backslash) sequences in an HTTP request to the cgi-bin directory.


Directory traversal vulnerability in the RPC interface (asdbapi.dll) in CA ARCserve Backup (formerly BrightStor ARCserve Backup) r11.1 through r12.0 allows remote attackers to execute arbitrary commands via a .. (dot dot) in an RPC call with opnum 0x10A.


Directory traversal vulnerability in the Admin Defined Commands (ADC) feature in gitolite before 1.5.9.1 allows remote attackers to execute arbitrary commands via .. (dot dot) sequences in admin-defined commands.


Directory traversal vulnerability in main.php in Merethis Centreon before 2.3.2 allows remote authenticated users to execute arbitrary commands via a .. (dot dot) in the command_name parameter.


Directory traversal vulnerability in HTTP server for Alchemy Eye and Alchemy Network Monitor allows remote attackers to execute arbitrary commands via an HTTP request containing (1) a .. in versions 2.0 through 2.6.18 or (2) a DOS device name followed by a .. in versions 2.6.19 through 3.0.10.

directory traversal
arbitrary command execution
dos


A directory traversal vulnerability in Trend Micro Apex One OfficeScan (11.0 XG) and Worry-Free Business Security (9.5 10.0) may allow an attacker to bypass authentication and log on to an affected product's management console as a root user. The vulnerability does not require authentication.

directory traversal
bypass authentication


An

issue

was

discovered

on

Xiaomi

Mi

WiFi

devices

before

There

is

a

directory

traversal

vulnerability

to

read

arbitrary

files

via

a

misconfigured

NGINX

alias

as

demonstrated

by

api-third-party/download/extdisks../etc/config/account.

With

this

vulnerability

the

attacker

can

bypass

authentication.


Directory traversal vulnerability in Ragnarok Online Control Panel 4.3.4a when the Apache HTTP Server is used allows remote attackers to bypass authentication via directory traversal sequences in a URI that ends with the name of a publicly available page as demonstrated by a \/...../\ sequence and an account_manage.php/login.php final component for reaching the protected account_manage.php page.


Directory traversal vulnerability in error.php in GuppY 4.6.3 4.5.16 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the id parameter. NOTE: this can be leveraged to bypass authentication and upload arbitrary files by including admin/inc/upload.inc and specifying certain multipart/form-data input for admin/inc/upload.inc.


index.php in Domenico Mancini PicoFlat CMS before 0.4.18 allows remote attackers to include certain files via unspecified vectors possibly due to a directory traversal vulnerability. NOTE: this can be leveraged to bypass authentication and upload files by including pico_insert.php or unspecified other administrative scripts. NOTE: some of these details are obtained from third party information.


Directory traversal vulnerability in am.pl in SQL-Ledger 2.6.27 only checks for the presence of a NULL (%00) character to protect against directory traversal attacks which allows remote attackers to run arbitrary executables and bypass authentication via a .. (dot dot) sequence in the login parameter.


Directory traversal vulnerability in am.pl in (1) SQL-Ledger 2.6.27 and earlier and (2) LedgerSMB before 1.2.0 allows remote attackers to run arbitrary executables and bypass authentication via a .. (dot dot) sequence and trailing NULL (%00) in the login parameter. NOTE: this issue was reportedly addressed in SQL-Ledger 2.6.27 however third-party researchers claim that the file is still executed even though an error is generated.


Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create arbitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty function which is used by the format_timestamp_name function.


Directory traversal vulnerability in Axis Network Camera 2.40 and earlier and Video Server 3.12 and earlier allows remote attackers to bypass authentication via a .. (dot dot) in an HTTP POST request to ServerManager.srv then use these privileges to conduct other activities such as modifying files using editcgi.cgi.


Directory traversal vulnerability in the web server on Honeywell Midas gas detectors before 1.13b3 and Midas Black gas detectors before 2.13b3 allows remote attackers to bypass authentication and write to a configuration file or trigger a calibration or test via unspecified vectors.


Trend Micro Worry-Free Business Security (9.0 9.5 10.0) is affected by a directory traversal vulnerability that could allow an attacker to manipulate a key file to bypass authentication.


Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device. For more information about these vulnerabilities see the Details section of this advisory.


Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Test Manager for Web Apps a different vulnerability than CVE-2016-0490. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the process method in the ActionServlet servlet which allows remote attackers to bypass authentication via directory traversal sequences following an unspecified URI string.


Unspecified

vulnerability

in

the

Oracle

Application

Testing

Suite

component

in

Oracle

Enterprise

Manager

Grid

Control

and

allows

remote

attackers

to

affect

confidentiality

and

integrity

via

unknown

vectors

related

to

Load

Testing

for

Web

Apps

a

different

vulnerability

than

NOTE:

the

previous

information

is

from

the

January

CPU.

Oracle

has

not

commented

on

third-party

claims

that

this

is

a

directory

traversal

vulnerability

in

the

isAllowedUrl

function

which

allows

remote

attackers

to

bypass

authentication

via

directory

traversal

sequences

following

a

URI

entry

that

does

not

require

authentication

as

demonstrated

by


Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Load Testing for Web Apps a different vulnerability than CVE-2016-0492. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the isAllowedUrl function in the admin pages which allows remote attackers to bypass authentication and gain administrator access via directory traversal sequences following a URI entry that does not require authentication.


Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authentication and access the admin interface via a .. (dot dot) in a URI that matches the Exclude-Strings list as demonstrated by a /setup/setup-/.. sequence in a URI.


Uebimiau Webmail 2.7.10 and 2.7.2 does not protect authentication state variables from being set through HTTP requests which allows remote attackers to bypass authentication via a sessauth=1 parameter settting. NOTE: this can be leveraged to conduct directory traversal attacks without authentication by using CVE-2008-0140.


Directory traversal vulnerability in inc/map.func.php in pragmaMX Landkarten 2.1 module allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the module_name parameter as demonstrated via a static PHP code injection attack in an Apache log file.


Multiple directory traversal vulnerabilities in CMS Chainuk 1.2 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the menu parameter to admin/admin_menu.php and the id parameter to (2) index.php and (3) admin/admin_edit.php; and (4) delete arbitrary local files via a .. (dot dot) in the id parameter to admin/admin_delete.php. NOTE: vector 2 can be leveraged for static code injection by sending a crafted menu parameter to admin/admin_menu.php and then sending an id=../menu.csv request to index.php.


Directory traversal vulnerability in LinPHA 1.0 allows remote attackers to include arbitrary files via .. (dot dot) sequences in the (1) lang parameter in docs/index.php and the language parameter in (2) install/install.php (3) install/sec_stage_install.php (4) install/third_stage_install.php and (5) install/forth_stage_install.php. NOTE: direct static code injection is resultant from this issue as demonstrated by inserting PHP code into the username which is inserted into linpha.log which is accessible from the directory traversal.


Directory traversal vulnerability in Zend Platform 2.2.1 and earlier allows remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in the final component of the PHP session identifier (PHPSESSID). NOTE: in some cases this issue can be leveraged to perform direct static code injection.


Directory traversal vulnerability in index.php in PhpMyFaq 1.5.1 allows remote attackers to read arbitrary files or include arbitrary PHP files via a .. (dot dot) in the LANGCODE parameter which also allows direct code injection via the User Agent field in a request packet which can be activated by using LANGCODE to reference the user tracking data file.


Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.10 possibly before revision 82710 allow remote attackers to hijack the authentication of administrators as demonstrated by requests that conduct directory traversal attacks via the group parameter to (1) plugin-preferences.php or (2) plugin-settings.php in www/admin a different vulnerability than CVE-2013-3514.

directory traversal
cross site request forgery


Multiple cross-site request forgery (CSRF) vulnerabilities on the TP-LINK WR1043N router with firmware TL-WR1043ND_V1_120405 allow remote attackers to hijack the authentication of administrators for requests that (1) enable FTP access (aka \FTP directory traversal\) to /tmp via the shareEntire parameter to userRpm/NasFtpCfgRpm.htm (2) change the FTP administrative password via the nas_admin_pwd parameter to userRpm/NasUserAdvRpm.htm (3) enable FTP on the WAN interface via the internetA parameter to userRpm/NasFtpCfgRpm.htm (4) launch the FTP service via the startFtp parameter to userRpm/NasFtpCfgRpm.htm or (5) enable or disable bandwidth limits via the QoSCtrl parameter to userRpm/QoSCfgRpm.htm.


Cross-site request forgery (CSRF) vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to hijack the authentication of administrators for requests that conduct directory traversal attacks via the tcp_box_path parameter in the checkout_editor_settings page to wp-admin/admin.php.


Directory traversal vulnerability in the captcha module in Pligg CMS before 1.2.2 allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the captcha parameter to module.php as demonstrated by cross-site request forgery (CSRF) attacks.


Directory traversal vulnerability in the doSendObjectInfo method in frameworks/av/media/mtp/MtpServer.cpp in Android 4.4.4 allows physically proximate attackers with a direct connection to the target Android device to upload files outside of the sdcard via a .. (dot dot) in a name parameter of an MTP request.


Directory traversal vulnerability in dodosmail.php in DodosMail 2.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the dodosmail_header_file parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Directory traversal vulnerability in ST FTP Service 3.0 allows remote attackers to list arbitrary directories via a CD command with a DoS drive letter argument (e.g. E:).


Directory traversal vulnerability in textview.php in Anton Vlasov DoSePa 1.0.4 allows remote attackers to read arbitrary files via a .. (dot dot) sequence or absolute file path in the file parameter.


On the Trend Micro Threat Discovery Appliance 2.6.1062r1 directory traversal when processing a session_id cookie allows a remote unauthenticated attacker to delete arbitrary files as root. This can be used to bypass authentication or cause a DoS.

directory traversal
dos
bypass authentication


An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp the server chooses which files/directories are sent to the client. However the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed the server can manipulate subdirectories as well (for example to overwrite the .ssh/authorized_keys file).


An issue was discovered on Samsung mobile devices with KK(4.4) and later software through 2015-06-16. In some cases HTTP is used for an Inputmethod rather than HTTPS. A man-in-the-middle attacker can modify the client-server data stream to insert directory traversal sequences into an extracted file path. The Samsung ID is SVE-2015-4363 (November 2015).


Directory traversal vulnerability in Eye-Fi Helper before 3.4.23 allows man-in-the-middle attackers to create arbitrary files via a .. (dot dot) in the filesignature in a GetPhotoStatus request.


DistUpgrade/DistUpgradeFetcherCore.py in Update Manager before 1:0.87.31.1 1:0.134.x before 1:0.134.11.1 1:0.142.x before 1:0.142.23.1 1:0.150.x before 1:0.150.5.1 and 1:0.152.x before 1:0.152.25.5 on Ubuntu 8.04 through 11.10 does not verify the GPG signature before extracting an upgrade tarball which allows man-in-the-middle attackers to (1) create or overwrite arbitrary files via a directory traversal attack using a crafted tar file or (2) bypass authentication via a crafted meta-release file.

directory traversal
man in the middle
bypass authentication


In all versions of GitLab CE/EE since version 12.0 a lower privileged user can import users from projects that they don't have a maintainer role on and disclose email addresses of those users.


The affected product is vulnerable to a SQL injection which may allow an unauthorized attacker to disclose information on the iView (versions prior to v5.7.03.6182).


An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4 watchOS 6.2. Setting an alternate app icon may disclose a photo without needing permission to access photos.


In all versions of GitLab CE/EE since version 11.3 the endpoint for auto-completing Assignee discloses the members of private groups.


The affected product is vulnerable to a disclosure of peer username and password by allowing all users access to read global variables.


Adobe Acrobat and Reader versions 2020.009.20074 and earlier 2020.001.30002 2017.011.30171 and earlier and 2015.006.30523 and earlier have a disclosure of sensitive data vulnerability. Successful exploitation could lead to memory leak.


Certain

NETGEAR

devices

are

affected

by

disclosure

of

sensitive

information.

This

affects

before

before

before

before

and

before


Certain NETGEAR devices are affected by disclosure of sensitive information. This affects WAC505 before 8.0.5.5 and WAC510 before 8.0.5.5.


Certain

NETGEAR

devices

are

affected

by

disclosure

of

sensitive

information.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by disclosure of sensitive information. This affects SRK60 before 2.3.5.106 SRR60 before 2.3.5.106 and SRS60 before 2.3.5.106.


NETGEAR MR1100 devices before 12.06.08.00 are affected by disclosure of sensitive information.


NETGEAR WAC510 devices before 5.0.10.2 are affected by disclosure of sensitive information.


NETGEAR RAX40 devices before 1.0.3.64 are affected by disclosure of sensitive information.


Certain NETGEAR devices are affected by disclosure of sensitive information. This affects WAC505 before V5.6.8.3 and WAC510 before V5.6.8.3.


NETGEAR WAC505 devices before 8.2.1.16 are affected by disclosure of sensitive information.


In Joomla! before 3.8.0 a logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archived state.


In Wireshark 3.0.0 to 3.0.1 2.6.0 to 2.6.8 and 2.4.0 to 2.4.14 the dissection engine could crash. This was addressed in epan/packet.c by restricting the number of layers and consequently limiting recursion.


In Wireshark 3.2.0 to 3.2.1 3.0.0 to 3.0.8 and 2.6.0 to 2.6.14 the WiMax DLMAP dissector could crash. This was addressed in plugins/epan/wimax/msg_dlmap.c by validating a length field.


In Wireshark 3.2.0 to 3.2.1 3.0.0 to 3.0.8 and 2.6.0 to 2.6.14 the EAP dissector could crash. This was addressed in epan/dissectors/packet-eap.c by using more careful sscanf parsing.


In Wireshark 3.2.0 to 3.2.6 3.0.0 to 3.0.13 and 2.6.0 to 2.6.20 the TCP dissector could crash. This was addressed in epan/dissectors/packet-tcp.c by changing the handling of the invalid 0xFFFF checksum.


In Wireshark 3.2.0 to 3.2.6 3.0.0 to 3.0.13 and 2.6.0 to 2.6.20 the MIME Multipart dissector could crash. This was addressed in epan/dissectors/packet-multipart.c by correcting the deallocation of invalid MIME parts.


In Wireshark 3.2.0 to 3.2.2 3.0.0 to 3.0.9 and 2.6.0 to 2.6.15 the BACapp dissector could crash. This was addressed in epan/dissectors/packet-bacapp.c by limiting the amount of recursion.


In Wireshark 2.6.0 2.4.0 to 2.4.6 and 2.2.0 to 2.2.14 the Q.931 dissector could crash. This was addressed in epan/dissectors/packet-q931.c by avoiding a use-after-free after a malformed packet prevented certain cleanup.


In GIFLIB before 2019-02-16 a malformed GIF file triggers a divide-by-zero exception in the decoder function DGifSlurp in dgif_lib.c if the height field of the ImageSize data structure is equal to zero.


Adobe s 11.0.19 and earlier 15.006.30280 and earlier 15.023.20070 and earlier have an insecure library loading (DLL hijacking) vulnerability in a DLL related to remote logging.


Adobe s 11.0.19 and earlier 15.006.30280 and earlier 15.023.20070 and earlier have an insecure library loading (DLL hijacking) vulnerability in the OCR plugin.


A vulnerability in the loading mechanism of specific dynamic link libraries in Cisco Jabber for Windows could allow an authenticated local attacker to perform a DLL preloading attack. To exploit this vulnerability the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of the resources loaded by the application at run time. An attacker could exploit this vulnerability by crafting a malicious DLL file and placing it in a specific location on the targeted system. The malicious DLL file would execute when the Jabber application launches. A successful exploit could allow the attacker to execute arbitrary code on the target machine with the privileges of another user's account.


A DLL search path vulnerability could allow privilege escalation in some Lenovo installation packages prior to version 1.2.9.3 during installation if an attacker already has administrative privileges.


A DLL search path vulnerability was reported in Lenovo Bootable Generator prior to version Mar-2019 that could allow a malicious user with local access to execute code on the system.


A DLL search path vulnerability was reported in Lenovo PCManager prior to version 3.0.500.5102 that could allow privilege escalation.


A DLL search path vulnerability was reported in Lenovo PCManager prior to version 3.0.400.3252 that could allow privilege escalation.


A DLL search path vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow privilege escalation.


A DLL search path vulnerability was reported in Lenovo Diagnostics prior to version 4.35.4 that could allow a user with local access to execute code on the system.


A DLL search path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that could allow an authenticated user to execute code with elevated privileges.


A DLL search path vulnerability was reported in the Lenovo HardwareScan Plugin for the Lenovo Vantage hardware scan feature prior to version 1.0.46.11 that could allow escalation of privilege.


In cPanel before 78.0.2 a Userdata cache temporary file can conflict with domains (SEC-478).


Microsoft SQL Server 7 2000 and MSDE allows local or remote authenticated users to cause a denial of service (crash or hang) via a long request to a named pipe.


In systemd 223 through 235 a remote DNS server can respond with a custom crafted DNS NSEC resource record to trigger an infinite loop in the dns_packet_read_type_window() function of the 'systemd-resolved' service and cause a DoS of the affected service.


On BIG-IP 14.1.0-14.1.0.5 14.0.0-14.0.0.4 13.0.0-13.1.1.4 and 12.1.0-12.1.4 undisclosed traffic sent to BIG-IP iSession virtual server may cause the Traffic Management Microkernel (TMM) to restart resulting in a Denial-of-Service (DoS).


On BIG-IP 14.1.0-14.1.0.5 14.0.0-14.0.0.4 13.0.0-13.1.1.4 and 12.1.0-12.1.4 an undisclosed traffic pattern sent to a BIG-IP UDP virtual server may lead to a denial-of-service (DoS).


Processing a maliciously crafted image may lead to disclosure of user information. This issue is fixed in macOS Big Sur 11.4 tvOS 14.6 watchOS 7.5 iOS 14.6 and iPadOS 14.6. This issue was addressed with improved checks.


Processing a maliciously crafted file may lead to arbitrary code execution. This issue is fixed in iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5. This issue was addressed with improved checks.


In all versions of ClickHouse before 19.14 an OOB read OOB write and integer underflow in decompression algorithms can be used to achieve RCE or DoS via native protocol.


An authentication issue was addressed with improved state management. This issue is fixed in iOS 15.4 and iPadOS 15.4. A person with physical access to an iOS device may be able to access photos from the lock screen.


An authentication issue was addressed with improved state management. This issue is fixed in iOS 14.2 and iPadOS 14.2. A person with physical access to an iOS device may be able to access stored passwords without authentication.


An authorization issue was addressed with improved state management. This issue is fixed in iOS 15 and iPadOS 15. A VPN configuration may be installed by an app without user permission.


An authorization issue was addressed with improved state management. This issue is fixed in iOS 15 and iPadOS 15 watchOS 8 tvOS 15. An attacker in physical proximity may be able to force a user onto a malicious Wi-Fi network during device setup.


An authorization issue was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5. A person with physical access to an iOS device may be able to view notification contents from the lockscreen.


An authorization issue was addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6 tvOS 13.4.8 watchOS 6.2.8. A malicious application may be able to read sensitive location information.


Under certain conditions on F5 BIG-IP ASM 13.1.0-13.1.0.5 Behavioral DOS (BADOS) protection may fail during an attack.


In CMS Made Simple (CMSMS) through 2.2.7 the \file move\ operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS exploitable by an admin user because config.php can be moved into an incorrect directory.


A component of the HarmonyOS has a Insufficient Verification of Data Authenticity vulnerability. Local attackers may exploit this vulnerability to cause persistent dos.


The default configuration of Dosemu in Corel Linux 1.0 allows local users to execute the system.com program and gain privileges.


A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. In that L1 guest could access L0's APIC register values via L2 guest when 'virtualize x2APIC mode' is enabled. A guest could use this flaw to potentially crash the host kernel resulting in DoS issue. Kernel versions from 4.16 and newer are vulnerable to this issue.


An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6 while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user maybe remote one could use this flaw to stall the vhost_net kernel thread resulting in a DoS scenario.


In the 3.1.3.64296 and lower version of 360F5 the third party can trigger the device to send a deauth frame by constructing and sending a specific illegal 802.11 Null Data Frame which will cause other wireless terminals connected to disconnect from the wireless so as to attack the router wireless by DoS. At present the vulnerability has been effectively handled and users can fix the vulnerability after updating the firmware version.


** DISPUTED ** An issue was discovered in ide_dma_cb() in hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest system can crash the QEMU process in the host system via a special SCSI_IOCTL_SEND_COMMAND. It hits an assertion that implies that the size of successful DMA transfers there must be a multiple of 512 (the size of a sector). NOTE: a member of the QEMU security team disputes the significance of this issue because a \privileged guest user has many ways to cause similar DoS effect without triggering this assert.\


A denial-of-service (DoS) vulnerability exists in Magento 2.1 prior to 2.1.18 Magento 2.2 prior to 2.2.9 Magento 2.3 prior to 2.3.2. By abusing insufficient brute-forcing defenses in the token exchange protocol an unauthenticated attacker could disrupt transactions between the Magento merchant and PayPal.


cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices allows a DoS (Hang) via the mask POST parameter.


parse-server before 3.4.1 allows DoS after any POST to a volatile class.


The Log module in SECUDOS DOMOS before 5.6 allows XSS.


A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 15; openSUSE Leap 15.1 Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-3.5.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-3.21.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.6.1. openSUSE Factory wicked versions prior to 0.6.62.


A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 15; openSUSE Leap 15.1 Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-2.18.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-28.26.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.9.1. openSUSE Factory wicked versions prior to 0.6.62.


The Log module in SECUDOS DOMOS before 5.6 allows local file inclusion.


A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise Module for Public Cloud 15-SP1 SUSE Linux Enterprise Module for Server Applications 15 SUSE Linux Enterprise Module for Server Applications 15-SP1 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1 allows remote attackers to cause DoS against rmt by requesting migrations. This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise High Performance Computing 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Public Cloud 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Module for Server Applications 15 rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Server Applications 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Server 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Server for SAP 15 rmt-server versions prior to 2.5.2-3.26.1. openSUSE Leap 15.1 rmt-server versions prior to 2.5.2-lp151.2.9.1.


There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python this results in an OverflowError or MemoryError due to the 2 GB limit. However on Linux running 64-bit Python this results in the process being terminated by the OOM killer.


It was found that the Red Hat Enterprise Linux 8 kpatch update did not include the complete fix for CVE-2018-12207. A flaw was found in the way Intel CPUs handle inconsistency between virtual to physical memory address translations in CPU's local cache and system software's Paging structure entries. A privileged guest user may use this flaw to induce a hardware Machine Check Error on the host processor resulting in a severe DoS scenario by halting the processor. System software like OS OR Virtual Machine Monitor (VMM) use virtual memory system for storing program instructions and data in memory. Virtual Memory system uses Paging structures like Page Tables and Page Directories to manage system memory. The processor's Memory Management Unit (MMU) uses Paging structure entries to translate program's virtual memory addresses to physical memory addresses. The processor stores these address translations into its local cache buffer called - Translation Lookaside Buffer (TLB). TLB has two parts one for instructions and other for data addresses. System software can modify its Paging structure entries to change address mappings OR certain attributes like page size etc. Upon such Paging structure alterations in memory system software must invalidate the corresponding address translations in the processor's TLB cache. But before this TLB invalidation takes place a privileged guest user may trigger an instruction fetch operation which could use an already cached but now invalid virtual to physical address translation from Instruction TLB (ITLB). Thus accessing an invalid physical memory address and resulting in halting the processor due to the Machine Check Error (MCE) on Page Size Change.


There is a DoS vulnerability in RTSP module of Leland-AL00A Huawei smart phones versions earlier than Leland-AL00A 9.1.0.111(C00E111R2P10T8). Remote attackers could trick the user into opening a malformed RTSP media stream to exploit this vulnerability. Successful exploit could cause the affected phone abnormal leading to a DoS condition. (Vulnerability ID: HWPSIRT-2019-02004)


DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands.


CloudEngine 12800 has a DoS vulnerability. An attacker of a neighboring device sends a large number of specific packets. As a result a memory leak occurs after the device uses the specific packet. As a result the attacker can exploit this vulnerability to cause DoS attacks on the target device.


Huawei S5700 and S6700 have a DoS security vulnerability. Attackers with certain permissions perform specific operations on affected devices. Because the pointer in the program is not processed properly the vulnerability can be exploited to cause the device to be abnormal.


Smartphones with software of ELLE-AL00B 9.1.0.109(C00E106R1P21) 9.1.0.113(C00E110R1P21) 9.1.0.125(C00E120R1P21) 9.1.0.135(C00E130R1P21) 9.1.0.153(C00E150R1P21) 9.1.0.155(C00E150R1P21) 9.1.0.162(C00E160R2P1) have an insufficient verification vulnerability. The system does not verify certain parameters sufficiently an attacker should connect to the phone and gain high privilege to launch the attack. Successful exploit could cause DOS or malicious code execution.


In Xpdf 4.01.01 the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack. This is similar to CVE-2018-16646.


A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse causing the stack to grow infinitely and eventually either crash or overwrite other data.


Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP options.


Wind River VxWorks 6.6 6.7 6.8 6.9 and vx7 has an array index error in the IGMPv3 client component. There is an IPNET security vulnerability: DoS via NULL dereference in IGMP parsing.


DOSBox 0.74-2 has Incorrect Access Control.


In http.c in Embedthis GoAhead before 4.1.1 and 5.x before 5.0.1 a header parsing vulnerability causes a memory assertion out-of-bounds memory reference and potential DoS as demonstrated by a colon on a line by itself.


The HC.Server service in Hosting Controller HC10 10.14 allows an Invalid Pointer Write DoS.


Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS. Passing invalid titles to the API could cause a DoS by querying the entire watchlist table. Fixed in 1.32.2 1.31.2 1.30.2 and 1.27.6.


PowerDNS Authoritative daemon pdns versions 4.0.x before 4.0.9 4.1.x before 4.1.11 exiting when encountering a serial between 2^31 and 2^32-1 while trying to notify a slave leads to DoS.


AsusPTPFilter.sys on Asus Precision TouchPad 11.0.0.25 hardware has a Pool Overflow associated with the \\\\.\\AsusTP device leading to a DoS or potentially privilege escalation via a crafted DeviceIoControl call.


A missing permission check in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handler method allowed attackers with Overall/Read permission to change the per-job default graph configuration for all users.


The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.


BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One can import a malicious XML file and perform XXE attacks to download local files from the server or do DoS attacks with XML expansion attacks. XXE with direct response and XXE OOB are allowed.


An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a local DoS attack vector but it might result as well in remote DoS if the XFS filesystem is exported for instance via NFS.


An issue was discovered in a smart contract implementation for MORPH Token through 2019-06-05 an Ethereum token. A typo in the constructor of the Owned contract (which is inherited by MORPH Token) allows attackers to acquire contract ownership. A new owner can subsequently obtain MORPH Tokens for free and can perform a DoS attack.


Kaspersky Anti-Virus Kaspersky Internet Security Kaspersky Total Security Kaspersky Free Anti-Virus Kaspersky Small Office Security Kaspersky Security Cloud up to 2020 the web protection component allowed an attacker remotely disable various anti-virus protection features. DoS Bypass.


In DIMO YellowBox CRM before 6.3.4 Path Traversal in images/Apparence (dossier=../) and servletrecuperefichier (document=../) allows an unauthenticated user to download arbitrary files from the server.


diag_tool.cgi on DASAN H660RM GPON routers with firmware 1.03-0022 lacks any authorization check which allows remote attackers to run a ping command via a GET request to enumerate LAN devices or crash the router with a DoS attack.


In FreeRADIUS 3.0.x before 3.0.20 the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.


app/system/admin/admin/index.class.php in MetInfo 7.0.0beta allows a CSRF attack to add a user account via a doSaveSetup action to admin/index.php as demonstrated by an admin/?n=admin&c=index&a=doSaveSetup URI.


The AsyncResponseWrapperImpl class in Apache Olingo versions 4.0.0 to 4.6.0 reads the Retry-After header and passes it to the Thread.sleep() method without any check. If a malicious server returns a huge value in the header then it can help to implement a DoS attack.


An

issue

was

discovered

in

MetInfo

There

is

SQL

injection

via

the

admin/?n=language&c=language_general&a=doSearchParameter

appno

parameter

a

different

issue

than


An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the admin/?n=tags&c=index&a=doSaveTags URI.


libarchive

version

commit

onwards

(version

onwards)

contains

a

Loop

with

Unreachable

Exit

Condition

('Infinite

Loop')

vulnerability

in

parser

that

can

result

in

DoS

by

infinite

loop.

This

attack

appears

to

be

exploitable

via

the

victim

opening

a

specially

crafted

file.


An inconsistency in Wi-Fi network configuration settings was addressed. This issue is fixed in iOS 13.2 and iPadOS 13.2. An attacker in physical proximity may be able to force a user onto a malicious Wi-Fi network during device setup.


A consistency issue existed in deciding when to show the screen recording indicator. The issue was resolved with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2. A local user may be able to record the screen without a visible screen recording indicator.

record screen without visible screen recording


A validation issue was addressed with improved logic. This issue is fixed in Safari 13.0.1 iOS 13.1 and iPadOS 13.1 iCloud for Windows 10.7 tvOS 13 iCloud for Windows 7.14 iTunes 12.10.1 for Windows. Processing maliciously crafted web content may lead to universal cross site scripting.


A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 13.2 and iPadOS 13.2 macOS Catalina 10.15.1. Parsing a maliciously crafted iBooks file may lead to disclosure of user information.


Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits


AultWare pwStore 2010.8.30.0 has DoS via an empty HTTP request


Cisco ACE A2(3.6) allows log retention DoS.


OpenShift haproxy cartridge: predictable /tmp in set-proxy connection hook which could facilitate DoS


A potential DoS vulnerability was discovered in GitLab CE/EE starting with version 13.7. Using a malformed TIFF images was possible to trigger memory exhaustion.


An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.3.6 all versions starting from 14.4 before 14.4.4 all versions starting from 14.5 before 14.5.2. A regular expression used for handling user input (notes comments etc) was susceptible to catastrophic backtracking that could cause a DOS attack.


A potential DOS vulnerability was discovered in GitLab starting with version 9.1 that allowed parsing files without authorisation.


A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 13.7. The stripping of EXIF data from certain images resulted in high CPU usage.


An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 14.3.6 all versions starting from 14.4 before 14.4.4 all versions starting from 14.5 before 14.5.2. A regular expression related to quick actions features was susceptible to catastrophic backtracking that could cause a DOS attack.


Pomerium is an open source identity-aware access proxy. Envoy which Pomerium is based on can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted *upstream* servers. 0.15.1 contains an upgraded envoy binary with this vulnerability patched. If only trusted upstreams are configured there is not substantial risk of this condition being triggered.


Pomerium is an open source identity-aware access proxy. Envoy which Pomerium is based on incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can result in a DoS condition. Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched.


A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways as well as to non-permanently DoS the system.


index.php/appointment/todos in Chikitsa Patient Management System 2.0.0 allows XSS.


An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.


An issue was discovered in Pillow before 8.2.0. For BLP data BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.


HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to be initialized before use and disposed of afterwards by calling a specific set of functions. Many internal data structures also require this initialize / dispose discipline but not all of them. When the \soft reset\ feature was implemented the libxl__domain_suspend_state structure didn't require any initialization or disposal. At some point later an initialization function was introduced for the structure; but the \soft reset\ path wasn't refactored to call the initialization function. When a guest nwo initiates a \soft reboot\ uninitialized data structure leads to an assert() when later code finds the structure in an unexpected state. The effect of this is to crash the process monitoring the guest. How this affects the system depends on the structure of the toolstack. For xl this will have no security-relevant effect: every VM has its own independent monitoring process which contains no state. The domain in question will hang in a crashed state but can be destroyed by `xl destroy` just like any other non-cooperating domain. For daemon-based toolstacks linked against libxl such as libvirt this will crash the toolstack losing the state of any in-progress operations (localized DoS) and preventing further administrator operations unless the daemon is configured to restart automatically (system-wide DoS). If crashes \leak\ resources then repeated crashes could use up resources also causing a system-wide DoS.


An issue was discovered in Pillow before 8.2.0. For EPS data the readline implementation used in EPSImageFile has to deal with any combination of \\r and \\n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase before an image was accepted for opening.


Denial-of-service (DoS) vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 allows remote authenticated attackers to prevent any user from authenticating by (1) enabling Time-based One-time password (TOTP) on behalf of the other user or (2) modifying the other user's TOTP shared secret.


An arbitrary file creation by privilege escalation vulnerability in Trend Micro Apex One Apex One as a Service Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services could allow a local attacker to create an arbitrary file with higher privileges that could lead to a denial-of-service (DoS) on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.


Linux distributions using CAP_SYS_NICE for gnome-shell may be exposed to a privilege escalation issue. An attacker with low privilege permissions may take advantage of the way CAP_SYS_NICE is currently implemented and eventually load code to increase its process scheduler priority leading to possible DoS of other services running in the same machine.


OctoRPKI does not limit the length of a connection allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically the repository that OctoRPKI sends HTTP requests to will keep the connection open for a day before a response is returned but does keep drip feeding new bytes to keep the connection alive.


A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect app on Windows systems allows a limited Windows user to send specifically-crafted input to the GlobalProtect app that results in a Windows blue screen of death (BSOD) error. This issue impacts: GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.8; GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.4.


Certain invalid URL entries contained in an External Dynamic List (EDL) cause the Device Server daemon (devsrvr) to stop responding. This condition causes subsequent commits on the firewall to fail and prevents administrators from performing commits and configuration changes even though the firewall remains otherwise functional. If the firewall then restarts it results in a denial-of-service (DoS) condition and the firewall stops processing traffic. This issue impacts: PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.9; PAN-OS 10.0 versions earlier than PAN-OS 10.0.5. PAN-OS 8.1 and PAN-OS 10.1 versions are not impacted.


A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS scenario.


RCE/DOS:

Linked-list

corruption

leading

to

large

out-of-bounds

write

while

sorting

for

forged

fragment

list

in

Zephyr.

Zephyr

versions

contain

Out-of-bounds

Write

For

more

information

see


A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. In addition the prior bug fix for CVE-2020-10753 did not account for the use of \\r as a header separator thus a new flaw has been created.


An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.3 iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5. A malicious application may be able to bypass Privacy preferences.


A port redirection issue was addressed with additional port validation. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave tvOS 14.4 watchOS 7.3 iOS 14.4 and iPadOS 14.4 Safari 14.0.3. A malicious website may be able to access restricted ports on arbitrary servers.


A privacy issue existed in the handling of Contact cards. This was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave iOS 14.4 and iPadOS 14.4. A malicious application may be able to leak sensitive user information.


A memory initialization issue was addressed with improved memory handling. This issue is fixed in Security Update 2021-002 Catalina Security Update 2021-003 Mojave iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5 macOS Big Sur 11.3. A malicious application may be able to disclose kernel memory.


A certificate validation issue was addressed. This issue is fixed in iOS 14.5 and iPadOS 14.5. An attacker in a privileged network position may be able to alter network traffic.


This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave watchOS 7.3 tvOS 14.4 iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted image may lead to arbitrary code execution.


A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave tvOS 14.4 watchOS 7.3 iOS 14.4 and iPadOS 14.4 Safari 14.0.3. Processing maliciously crafted web content may lead to arbitrary code execution.


A logic issue was addressed with improved state management. This issue is fixed in Security Update 2021-002 Catalina Security Update 2021-003 Mojave iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5 macOS Big Sur 11.3. A local attacker may be able to elevate their privileges.


A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..


A validation issue was addressed with improved logic. This issue is fixed in Security Update 2021-002 Catalina Security Update 2021-003 Mojave iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5 macOS Big Sur 11.3. A malicious application may be able to gain root privileges.


Processing a maliciously crafted image may lead to arbitrary code execution. This issue is fixed in Security Update 2021-002 Catalina iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5 macOS Big Sur 11.3. An out-of-bounds write issue was addressed with improved bounds checking.


A double free issue was addressed with improved memory management. This issue is fixed in Security Update 2021-002 Catalina Security Update 2021-003 Mojave iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5 macOS Big Sur 11.3. Processing a maliciously crafted file may lead to heap corruption.


A logic issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave watchOS 7.3 tvOS 14.4 iOS 14.4 and iPadOS 14.4. A malicious attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.

arbitrary read
bypass pointer authentication


An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave watchOS 7.3 tvOS 14.4 iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted image may lead to arbitrary code execution.


An issue obscuring passwords in screenshots was addressed with improved logic. This issue is fixed in iOS 14.5 and iPadOS 14.5. A user's password may be visible on screen.


A call termination issue with was addressed with improved logic. This issue is fixed in iOS 14.5 and iPadOS 14.5. A legacy cellular network can automatically answer an incoming call when an ongoing call ends or drops. .


A logic issue was addressed with improved state management. This issue is fixed in iTunes 12.11.3 for Windows Security Update 2021-002 Catalina Security Update 2021-003 Mojave iCloud for Windows 12.3 macOS Big Sur 11.3 watchOS 7.4 tvOS 14.5 iOS 14.5 and iPadOS 14.5. Processing a maliciously crafted font may result in the disclosure of process memory.


A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.3 iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5. Processing maliciously crafted web content may result in the disclosure of process memory.


A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue is fixed in iOS 14.4 and iPadOS 14.4. An attacker with physical access to a device may be able to see private contact information.


A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Big Sur 11.3 iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5. A local user may be able to modify protected parts of the file system.


This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave watchOS 7.3 tvOS 14.4 iOS 14.4 and iPadOS 14.4. Maliciously crafted web content may violate iframe sandboxing policy.


A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave watchOS 7.3 tvOS 14.4 iOS 14.4 and iPadOS 14.4. A local user may be able to create or modify system files.


A stack overflow was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave watchOS 7.3 tvOS 14.4 iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted text file may lead to arbitrary code execution.


A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in Security Update 2021-002 Catalina Security Update 2021-003 Mojave iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5 macOS Big Sur 11.3. A local user may be able to modify protected parts of the file system.


A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave watchOS 7.3 tvOS 14.4 iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.


An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave watchOS 7.3 tvOS 14.4 iOS 14.4 and iPadOS 14.4. Processing maliciously crafted web content may lead to code execution.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave watchOS 7.3 tvOS 14.4 iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted font file may lead to arbitrary code execution.

out of bound write
arbitrary code execution


Multiple issues were addressed with improved logic. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave watchOS 7.3 tvOS 14.4 iOS 14.4 and iPadOS 14.4. A local attacker may be able to elevate their privileges.


A memory initialization issue was addressed with improved memory handling. This issue is fixed in iTunes 12.11.3 for Windows Security Update 2021-002 Catalina Security Update 2021-003 Mojave iCloud for Windows 12.3 macOS Big Sur 11.3 watchOS 7.4 tvOS 14.5 iOS 14.5 and iPadOS 14.5. Processing maliciously crafted web content may disclose sensitive user information.


This issue was addressed with improved checks. This issue is fixed in Security Update 2021-004 Mojave iOS 14.5 and iPadOS 14.5 watchOS 7.4 Security Update 2021-003 Catalina tvOS 14.5 macOS Big Sur 11.3. Processing maliciously crafted server messages may lead to heap corruption.


An input validation issue was addressed with improved input validation. This issue is fixed in iTunes 12.11.3 for Windows iCloud for Windows 12.3 macOS Big Sur 11.3 Safari 14.1 watchOS 7.4 tvOS 14.5 iOS 14.5 and iPadOS 14.5. Processing maliciously crafted web content may lead to a cross site scripting attack.


The issue was addressed with improved permissions logic. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave watchOS 7.3 tvOS 14.4 iOS 14.4 and iPadOS 14.4. A local user may be able to read arbitrary files.


On BIG-IP version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3 when the iRules RESOLVER::summarize command is used on a virtual server undisclosed requests can cause an increase in Traffic Management Microkernel (TMM) memory utilization resulting in an out-of-memory condition and a denial-of-service (DoS). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.


An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted OpenPGP key with a subkey that has an invalid self signature and the Thunderbird user imports the crafted key then Thunderbird may try to use the invalid subkey but the RNP library rejects it from being used causing encryption to fail. This vulnerability affects Thunderbird < 78.9.1.


A vulnerability found in UniFi Switch firmware Version 5.43.35 and earlier allows a malicious actor who has already gained access to the network to perform a Deny of Service (DoS) attack on the affected switch.This vulnerability is fixed in UniFi Switch firmware 5.76.6 and later.


National

Library

of

the

Netherlands

multiNER

is

affected

by

an

XML

External

Entity

(XXE)

vulnerability

in

multiNER/ner.py.

Since

XML

parsing

resolves

external

entities

a

malicious

XML

stream

could

leak

internal

files

and/or

cause

a

DoS.


A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Linux Security whereby the Fmlib component used in certain F-Secure products can crash while scanning fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will result in Denial-of-Service of the Anti-Virus engine.


A reachable assertion vulnerability in Trend Micro Apex One could allow an attacker to crash the program on affected installations leading to a denial-of-service (DoS). Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.


National

Library

of

the

Netherlands

digger

is

affected

by

a

XML

External

Entity

(XXE)

vulnerability.

Since

XML

parsing

resolves

external

entities

a

malicious

XML

stream

could

leak

internal

files

and/or

cause

a

DoS.


A link following denial-of-service (DoS) vulnerability in the Trend Micro Security (Consumer) 2021 familiy of products could allow an attacker to abuse the PC Health Checkup feature of the product to create symlinks that would allow modification of files which could lead to a denial-of-service.


Missing Release of Resource after Effective Lifetime vulnerability in OpenSSL implementation of WAGO 750-831/xxx-xxx 750-880/xxx-xxx 750-881 750-889 in versions FW4 up to FW15 allows an unauthenticated attacker to cause DoS on the device.


Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack through special crafted JSON requests.


In Eclipse Mosquitto version 1.6 to 2.0.10 if an authenticated client that had connected with MQTT v5 sent a crafted CONNECT message to the broker a memory leak would occur which could be used to provide a DoS attack against the broker.


There is a Remote DoS vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability can affect service integrity.


On all 7.x versions (fixed in 8.0.0) when set up for auto failover a BIG-IQ Data Collection Device (DCD) cluster member that receives an undisclosed message may cause the corosync process to abort. This behavior may lead to a denial-of-service (DoS) and impact the stability of a BIG-IQ high availability (HA) cluster. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.


The Bluetooth function of some Huawei smartphones has a DoS vulnerability. Attackers can install third-party apps to send specific broadcasts causing the Bluetooth module to crash. This vulnerability is successfully exploited to cause the Bluetooth function to become abnormal. Affected product versions include: HUAWEI P30 10.0.0.195(C432E22R2P5) 10.0.0.200(C00E85R2P11) 10.0.0.200(C461E6R3P1) 10.0.0.201(C10E7R5P1) 10.0.0.201(C185E4R7P1) 10.0.0.206(C605E19R1P3) 10.0.0.209(C636E6R3P4) 10.0.0.210(C635E3R2P4) and versions earlier than 10.1.0.165(C01E165R2P11).


CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)). Instead of sending a JWT token as a \request\ parameter the spec also supports specifying a URI from which to retrieve a JWT token from via the \request_uri\ parameter. CXF was not validating the \request_uri\ parameter (apart from ensuring it uses \https) and was making a REST request to the parameter in the request to retrieve a token. This means that CXF was vulnerable to DDos attacks on the authorization server as specified in section 10.4.1 of the spec. This issue affects Apache CXF versions prior to 3.4.3; Apache CXF versions prior to 3.3.10.


There is a issue of IP address spoofing in Huawei Smartphone. Successful exploitation of this vulnerability may cause DoS.


On BIG-IP Advanced WAF and BIG-IP ASM versions 16.0.x before 16.0.1.1 15.1.x before 15.1.2 14.1.x before 14.1.3.1 13.1.x before 13.1.3.6 and 12.1.x before 12.1.5.3 DOM-based XSS on DoS Profile properties page. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.


A component of HarmonyOS 2.0 has a DoS vulnerability. Local attackers may exploit this vulnerability to mount a file system to the target device causing DoS of the file system.


Spring Security versions 5.5.x prior to 5.5.1 5.4.x prior to 5.4.7 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant which has the potential of exhausting system resources using a single session or multiple sessions.


On BIG-IP APM version 16.0.x before 16.0.1.1 under certain conditions when processing VPN traffic with APM TMM consumes excessive memory. A malicious authenticated VPN user may abuse this to perform a DoS attack against the APM. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.


Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above which allows an attacker to spike the server resource utilization via gitlab-shell command.


There is a DoS vulnerability in smartphones. Successful exploitation of this vulnerability may affect service availability.


There is a DoS vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause DoS attacks.


A

redirect

vulnerability

in

the

`fastify-static`

module

version

and

allows

remote

attackers

to

redirect

Mozilla

Firefox

users

to

arbitrary

websites

via

a

double

slash

followed

by

a

domain:

DOS

vulnerability

is

possible

if

the

URL

contains

invalid

characters

`curl

--path-as-is

issue

shows

up

on

all

the

`fastify-static`

applications

that

set

`redirect:

true`

option.

By

default

it

is

`false`.


A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in dependencies API.


On BIG-IP Advanced WAF and ASM version 15.1.x before 15.1.0.2 15.0.x before 15.0.1.4 14.1.x before 14.1.2.5 13.1.x before 13.1.3.4 12.1.x before 12.1.5.2 and 11.6.x before 11.6.5.2 when receiving a unauthenticated client request with a maliciously crafted URI a BIG-IP Advanced WAF or ASM virtual server configured with a DoS profile with Proactive Bot Defense (versions prior to 14.1.0) or a Bot Defense profile (versions 14.1.0 and later) may subject clients and web servers to Open Redirection attacks. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.


Improper check or handling of exceptional conditions in LOGITEC LAN-W300N/PR5B allows a remote attacker to cause a denial-of-service (DoS) condition by sending a specially crafted URL.


mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors.


Lack of administrator control over security vulnerability in MELSEC-F series FX3U-ENET Firmware version 1.14 and prior FX3U-ENET-L Firmware version 1.14 and prior and FX3U-ENET-P502 Firmware version 1.14 and prior allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition in communication function of the product or other unspecified effects by sending specially crafted packets to an unnecessary opening of TCP port. Control by MELSEC-F series PLC is not affected by this vulnerability but system reset is required for recovery.


Improper initialization vulnerability in MELSEC-F series FX3U-ENET Firmware version 1.16 and prior FX3U-ENET-L Firmware version 1.16 and prior and FX3U-ENET-P502 Firmware version 1.16 and prior allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition in communication function of the product by sending specially crafted packets. Control by MELSEC-F series PLC is not affected by this vulnerability but system reset is required for recovery.


Missing synchronization vulnerability in GOT2000 series GT27 model communication driver versions 01.19.000 through 01.39.010 GT25 model communication driver versions 01.19.000 through 01.39.010 and GT23 model communication driver versions 01.19.000 through 01.39.010 and GT SoftGOT2000 versions 1.170C through 1.256S allows a remote unauthenticated attacker to cause DoS condition on the MODBUS/TCP slave communication function of the products by rapidly and repeatedly connecting and disconnecting to and from the MODBUS/TCP communication port on a target. Restart or reset is required to recover.


Resource management errors vulnerability in a robot controller of MELFA FR Series(controller \CR800-*V*D\ of RV-*FR***-D-* all versions controller \CR800-*HD\ of RH-*FRH***-D-* all versions controller \CR800-*HRD\ of RH-*FRHR***-D-* all versions controller \CR800-*V*R with R16RTCPU\ of RV-*FR***-R-* all versions controller \CR800-*HR with R16RTCPU\ of RH-*FRH***-R-* all versions controller \CR800-*HRR with R16RTCPU\ of RH-*FRHR***-R-* all versions controller \CR800-*V*Q with Q172DSRCPU\ of RV-*FR***-Q-* all versions controller \CR800-*HQ with Q172DSRCPU\ of RH-*FRH***-Q-* all versions controller \CR800-*HRQ with Q172DSRCPU\ of RH-*FRHR***-Q-* all versions) and a robot controller of MELFA CR Series(controller \CR800-CVD\ of RV-8CRL-D-* all versions controller \CR800-CHD\ of RH-*CRH**-D-* all versions) as well as a cooperative robot ASSISTA(controller \CR800-05VD\ of RV-5AS-D-* all versions) allows a remote unauthenticated attacker to cause a DoS of the execution of the robot program and the Ethernet communication by sending a large amount of packets in burst over a short period of time. As a result of DoS an error may occur. A reset is required to recover it if the error occurs.


Integer Underflow vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior MELSOFT Navigator all versions and EZSocket all versions allows an attacker to cause a DoS condition in the software by getting a user to open malicious project file specially crafted by an attacker.


Uncontrolled Resource Consumption vulnerability in MELSEC iQ-R Series R00/01/02CPU Firmware versions \24\ and prior MELSEC iQ-R Series R04/08/16/32/120(EN)CPU Firmware versions \57\ and prior MELSEC iQ-R Series R08/16/32/120SFCPU All versions MELSEC iQ-R Series R08/16/32/120PCPU Firmware versions \29\ and prior MELSEC iQ-R Series R08/16/32/120PSFCPU All versions MELSEC iQ-R Series R16/32/64MTCPU All versions MELSEC iQ-R Series R12CCPU-V All versions MELSEC Q Series Q03UDECPU The first 5 digits of serial No. \23121\ and prior MELSEC Q Series Q04/06/10/13/20/26/50/100UDEHCPU The first 5 digits of serial No. \23121\ and prior MELSEC Q Series Q03/04/06/13/26UDVCPU The first 5 digits of serial No. \23071\ and prior MELSEC Q Series Q04/06/13/26UDPVCPU The first 5 digits of serial No. \23071\ and prior MELSEC Q Series Q12DCCPU-V The first 5 digits of serial No. \24031\ and prior MELSEC Q Series Q24DHCCPU-V(G) The first 5 digits of serial No. \24031\ and prior MELSEC Q Series Q24/26DHCCPU-LS The first 5 digits of serial No. \24031\ and prior MELSEC Q Series MR-MQ100 Operating system software version \F\ and prior MELSEC Q Series Q172/173DCPU-S1 Operating system software version \W\ and prior MELSEC Q Series Q172/173DSCPU All versions MELSEC Q Series Q170MCPU Operating system software version \W\ and prior MELSEC Q Series Q170MSCPU(-S1) All versions MELSEC L Series L02/06/26CPU(-P) The first 5 digits of serial No. \23121\ and prior MELSEC L Series L26CPU-(P)BT The first 5 digits of serial No. \23121\ and prior and MELIPC Series MI5122-VW All versions allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by sending specially crafted packets. System reset is required for recovery.


Improper check or handling of exceptional conditions in LOGITEC LAN-W300N/RS allows a remote attacker to cause a denial-of-service (DoS) condition by sending a specially crafted URL.


Improper Input Validation vulnerability in MELSEC iQ-R Series R00/01/02CPU Firmware versions \24\ and prior MELSEC iQ-R Series R04/08/16/32/120(EN)CPU Firmware versions \57\ and prior MELSEC iQ-R Series R08/16/32/120SFCPU All versions MELSEC iQ-R Series R08/16/32/120PCPU Firmware versions \29\ and prior MELSEC iQ-R Series R08/16/32/120PSFCPU All versions MELSEC iQ-R Series R16/32/64MTCPU All versions MELSEC iQ-R Series R12CCPU-V All versions MELSEC Q Series Q03UDECPU The first 5 digits of serial No. \23121\ and prior MELSEC Q Series Q04/06/10/13/20/26/50/100UDEHCPU The first 5 digits of serial No. \23121\ and prior MELSEC Q Series Q03/04/06/13/26UDVCPU The first 5 digits of serial No. \23071\ and prior MELSEC Q Series Q04/06/13/26UDPVCPU The first 5 digits of serial No. \23071\ and prior MELSEC Q Series Q12DCCPU-V The first 5 digits of serial No. \24031\ and prior MELSEC Q Series Q24DHCCPU-V(G) The first 5 digits of serial No. \24031\ and prior MELSEC Q Series Q24/26DHCCPU-LS The first 5 digits of serial No. \24031\ and prior MELSEC Q Series MR-MQ100 Operating system software version \F\ and prior MELSEC Q Series Q172/173DCPU-S1 Operating system software version \W\ and prior MELSEC Q Series Q172/173DSCPU All versions MELSEC Q Series Q170MCPU Operating system software version \W\ and prior MELSEC Q Series Q170MSCPU(-S1) All versions MELSEC L Series L02/06/26CPU(-P) The first 5 digits of serial No. \23121\ and prior MELSEC L Series L26CPU-(P)BT The first 5 digits of serial No. \23121\ and prior and MELIPC Series MI5122-VW All versions allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by sending specially crafted packets. System reset is required for recovery.


Improper handling of length parameter inconsistency vulnerability in Mitsubishi Electric FA Engineering Software(C Controller module setting and monitoring tool all versions CPU Module Logging Configuration Tool versions 1.112R and prior CW Configurator versions 1.011M and prior Data Transfer versions 3.44W and prior EZSocket all versions FR Configurator all versions FR Configurator SW3 all versions FR Configurator2 versions 1.24A and prior GT Designer3 Version1(GOT1000) versions 1.250L and prior GT Designer3 Version1(GOT2000) versions 1.250L and prior GT SoftGOT1000 Version3 versions 3.245F and prior GT SoftGOT2000 Version1 versions 1.250L and prior GX Configurator-DP versions 7.14Q and prior GX Configurator-QP all versions GX Developer versions 8.506C and prior GX Explorer all versions GX IEC Developer all versions GX LogViewer versions 1.115U and prior GX RemoteService-I all versions GX Works2 versions 1.597X and prior GX Works3 versions 1.070Y and prior iQ Monozukuri ANDON (Data Transfer) all versions iQ Monozukuri Process Remote Monitoring (Data Transfer) all versions M_CommDTM-HART all versions M_CommDTM-IO-Link all versions MELFA-Works versions 4.4 and prior MELSEC WinCPU Setting Utility all versions MELSOFT EM Software Development Kit (EM Configurator) all versions MELSOFT Navigator versions 2.74C and prior MH11 SettingTool Version2 versions 2.004E and prior MI Configurator all versions MT Works2 versions 1.167Z and prior MX Component versions 5.001B and prior Network Interface Board CC IE Control utility all versions Network Interface Board CC IE Field Utility all versions Network Interface Board CC-Link Ver.2 Utility all versions Network Interface Board MNETH utility all versions PX Developer versions 1.53F and prior RT ToolBox2 versions 3.73B and prior RT ToolBox3 versions 1.82L and prior Setting/monitoring tools for the C Controller module all versions SLMP Data Collector versions 1.04E and prior) allows a remote unauthenticated attacker to cause a DoS condition of the software products and possibly to execute a malicious program on the personal computer running the software products although it has not been reproduced by spoofing MELSEC GOT or FREQROL and returning crafted reply packets.


An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an interrupt ID to the controller memory area it is not masked to be 4 bits wide. It may lead to the said issue while updating controller state fields and their subsequent processing. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.


Uncontrolled resource consumption in MELSEC iQ-R series C Controller Module R12CCPU-V all versions allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by sending a large number of packets in a short time while the module starting up. System reset is required for recovery.


Improper Restriction of XML External Entity Reference vulnerability in Mitsubishi Electric Air Conditioning System/Centralized Controllers (G-50A Ver.3.35 and prior GB-50A Ver.3.35 and prior GB-24A Ver.9.11 and prior AG-150A-A Ver.3.20 and prior AG-150A-J Ver.3.20 and prior GB-50ADA-A Ver.3.20 and prior GB-50ADA-J Ver.3.20 and prior EB-50GU-A Ver 7.09 and prior EB-50GU-J Ver 7.09 and prior AE-200A Ver 7.93 and prior AE-200E Ver 7.93 and prior AE-50A Ver 7.93 and prior AE-50E Ver 7.93 and prior EW-50A Ver 7.93 and prior EW-50E Ver 7.93 and prior TE-200A Ver 7.93 and prior TE-50A Ver 7.93 and prior TW-50A Ver 7.93 and prior CMS-RMD-J Ver.1.30 and prior) Air Conditioning System/Expansion Controllers (PAC-YG50ECA Ver.2.20 and prior) and Air Conditioning System/BM adapter(BAC-HD150 Ver.2.21 and prior) allows a remote unauthenticated attacker to disclose some of data in the air conditioning system or cause a DoS condition by sending specially crafted packets.


Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior allows a remote unauthenticated attacker to cause a DoS condition in GX Works2 by getting GX Works2 to read a tampered program file from a Mitsubishi Electric PLC by sending malicious crafted packets to tamper with the program file.


Improper Handling of Length Parameter Inconsistency vulnerability in MELSEC iQ-R Series R00/01/02CPU Firmware versions \24\ and prior MELSEC iQ-R Series R04/08/16/32/120(EN)CPU Firmware versions \57\ and prior MELSEC iQ-R Series R08/16/32/120SFCPU All versions MELSEC iQ-R Series R08/16/32/120PCPU Firmware versions \29\ and prior MELSEC iQ-R Series R08/16/32/120PSFCPU All versions MELSEC iQ-R Series R16/32/64MTCPU All versions MELSEC iQ-R Series R12CCPU-V All versions MELSEC Q Series Q03UDECPU The first 5 digits of serial No. \23121\ and prior MELSEC Q Series Q04/06/10/13/20/26/50/100UDEHCPU The first 5 digits of serial No. \23121\ and prior MELSEC Q Series Q03/04/06/13/26UDVCPU The first 5 digits of serial No. \23071\ and prior MELSEC Q Series Q04/06/13/26UDPVCPU The first 5 digits of serial No. \23071\ and prior MELSEC Q Series Q12DCCPU-V The first 5 digits of serial No. \24031\ and prior MELSEC Q Series Q24DHCCPU-V(G) The first 5 digits of serial No. \24031\ and prior MELSEC Q Series Q24/26DHCCPU-LS The first 5 digits of serial No. \24031\ and prior MELSEC Q Series MR-MQ100 Operating system software version \F\ and prior MELSEC Q Series Q172/173DCPU-S1 Operating system software version \W\ and prior MELSEC Q Series Q172/173DSCPU All versions MELSEC Q Series Q170MCPU Operating system software version \W\ and prior MELSEC Q Series Q170MSCPU(-S1) All versions MELSEC L Series L02/06/26CPU(-P) The first 5 digits of serial No. \23121\ and prior MELSEC L Series L26CPU-(P)BT The first 5 digits of serial No. \23121\ and prior and MELIPC Series MI5122-VW All versions allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by sending specially crafted packets. System reset is required for recovery.


The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack


There is a Service logic vulnerability in Smartphone.Successful exploitation of this vulnerability may cause WLAN DoS.


Skytable is an open source NoSQL database. In versions prior to 0.6.4 an incorrect check of return value of the accept function in the run-loop for a TCP socket/TLS socket/TCP+TLS multi-socket causes an early exit from the run loop that should continue infinitely unless terminated by a local user effectively causing the whole database server to shut down. This has severe impact and can be used to easily cause DoS attacks without the need to use much bandwidth. The attack vectors include using an incomplete TLS connection for example by not providing the certificate for the connection and using a specially crafted TCP packet that triggers the application layer backoff algorithm.


There is a Service logic vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause WLAN DoS.


There is a Remote DoS vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause the app to exit unexpectedly.


There is a DoS vulnerability in smartphones. Successful exploitation of this vulnerability may affect service integrity.


There is a Business Logic Errors vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to persistent dos.


jpress

v

is

vulnerable

to

RCE

via

io.jpress.module.product.ProductNotifyKit#doSendEmail.

The

admin

panel

provides

a

function

through

which

attackers

can

edit

the

email

templates

and

inject

some

malicious

code.


ForeScout - SecureConnector Local Service DoS - A low privilaged user which doesn't have permissions to shutdown the secure connector service writes a large amount of characters in the installationPath. This will cause the buffer to overflow and override the stack cookie causing the service to crash.


A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).


It's possible to create an email which can be stuck while being processed by PostMaster filters causing DoS. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions; 8.0.x version 8.0.15 and prior versions.


A Denial-of-Service (DoS) vulnerability was discovered in Team Server in HelpSystems Cobalt Strike 4.2 and 4.3. It allows remote attackers to crash the C2 server thread and block beacons' communication with it.


A Incorrect Default Permissions vulnerability in the parsec package of openSUSE Factory allows local attackers to imitate the service leading to DoS or clients talking to an imposter service. This issue affects: openSUSE Factory parsec versions prior to 0.8.1-1.1.


Vapor is a web framework for Swift. In Vapor before version 4.40.1 there is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app. The following is the attack vector: 1. send unlimited requests against a vapor instance with different paths. this will create unlimited counters and timers which will eventually drain the system. 2. downstream services might suffer from this attack as well by being spammed with error paths. This has been patched in 4.40.1. The `DefaultResponder` will rewrite any undefined route paths for to `vapor_route_undefined` to avoid unlimited counters.


Schema-Inspector

is

an

open-source

tool

to

sanitize

and

validate

JS

objects

(npm

package

schema-inspector).

In

before

version

email

address

validation

is

vulnerable

to

a

denial-of-service

attack

where

some

input

(for

example

`a@0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.`)

will

freeze

the

program

or

web

browser

page

executing

the

code.

This

affects

any

current

schema-inspector

users

using

any

version

to

validate

email

addresses.

Users

who

do

not

do

email

validation

and

instead

do

other

types

of

validation

(like

string

min

or

max

length

etc)

are

not

affected.

Users

should

upgrade

to

version

which

uses

a

regex

expression

that

isn't

vulnerable

to

ReDoS.


DoS attack can be performed when an email contains specially designed URL in the body. It can lead to the high CPU usage and cause low quality of service or in extreme case bring the system to a halt. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.26 and prior versions; 8.0.x version 8.0.13 and prior versions.


In radare2 through 5.3.0 there is a double free vulnerability in the pyc parse via a crafted file which can lead to DoS.


It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of the stack frames used by that stage. If an attacker could cause such an aggregation to occur they could maliciously crash MongoDB in a DoS attack. This vulnerability affects MongoDB versions prior to 5.0.4 4.4.11 4.2.16.


An issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-service (DoS) attacks via memory exhaustion when running under Lua 5.2 or Lua 5.3.


In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in BinData to be created. For example BinData::Bit100000 BinData::Bit100001 BinData::Bit100002 BinData::Bit<N>. In combination with <user_input>.constantize there is a potential for a CPU-based DoS. In version 2.4.10 bindata improved the creation time of Bits and Integers.


OOB read vulnerability in libsaacextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to execute remote DoS via forged aac file.


An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.


jsx-slack is a library for building JSON objects for Slack Block Kit surfaces from JSX. In versions prior to 4.5.1 users are vulnerable to a regular expression denial-of-service (ReDoS) attack. If attacker can put a lot of JSX elements into `<blockquote>` tag an internal regular expression for escaping characters may consume an excessive amount of computing resources. jsx-slack v4.5.1 has patched to a regex for escaping blockquote characters. Users are advised to upgrade as soon as possible.


A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Linux Security whereby the FSAVD component used in certain F-Secure products can crash while scanning larger packages/fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will result in Denial-of-Service (DoS) of the Anti-Virus engine.


The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.


A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the SAVAPI component used in certain F-Secure products can crash while scanning fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will result in Denial-of-Service (DoS) of the Anti-Virus engine.


A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the AVPACK module component used in certain F-Secure products can crash while scanning a fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will result in Denial-of-Service (DoS) of the Anti-Virus engine.


A Denial-of-Service (DoS) vulnerability was discovered in all versions of F-Secure Atlant whereby the SAVAPI component used in certain F-Secure products can crash while scanning fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will result in Denial-of-Service (DoS) of the Anti-Virus engine.


User controlled `request.getHeader(\Referer\)` `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially crafted Referer header programmatically. Since the attacker controls the string and the regex pattern he may cause a ReDoS by regex catastrophic backtracking on the server side. This problem has been fixed in Roller 6.0.2.


A denial-of-service (DoS) vulnerability was discovered in the web user interface of F-Secure Internet Gatekeeper. The vulnerability occurs because of an attacker can trigger assertion via malformed HTTP packet to web interface. An unauthenticated attacker could exploit this vulnerability by sending a large username parameter. A successful exploitation could lead to a denial-of-service of the product.


An HTTP request smuggling attack in TP-Link AX10v1 before v1_211117 allows a remote unauthenticated attacker to DoS the web application via sending a specific HTTP packet.


An HTTP request smuggling in web application in ASUS ROG Rapture GT-AX11000 RT-AX3000 RT-AX55 RT-AX56U RT-AX56U_V2 RT-AX58U RT-AX82U RT-AX82U GUNDAM EDITION RT-AX86 Series(RT-AX86U/RT-AX86S) RT-AX86U ZAKU II EDITION RT-AX88U RT-AX92U TUF Gaming AX3000 TUF Gaming AX5400 (TUF-AX5400) ASUS ZenWiFi XD6 ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898 and RT-AX68U before 3.0.0.4.386.45911 allows a remote unauthenticated attacker to DoS via sending a specially crafted HTTP packet.


Zulip

is

an

open

source

team

chat

server.

In

affected

versions

Zulip

allows

organization

administrators

on

a

server

to

configure

\linkifiers\

that

automatically

create

links

from

messages

that

users

send

detected

via

arbitrary

regular

expressions.

Malicious

organization

administrators

could

subject

the

server

to

a

denial-of-service

via

regular

expression

complexity

attacks;

most

simply

by

configuring

a

quadratic-time

regular

expression

in

a

linkifier

and

sending

messages

that

exploited

it.

A

regular

expression

attempted

to

parse

the

user-provided

regexes

to

verify

that

they

were

safe

from

ReDoS

this

was

both

insufficient

as

well

as

subject

to

ReDoS

if

the

organization

administrator

entered

a

sufficiently

complex

invalid

regex.

Affected

users

should

upgrade

to

the

just-released

Zulip

or


A DoS attack in the web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote unauthenticated attacker to reboot the router via sending a specially crafted URL to an authenticated victim. The authenticated victim need to visit this URL for the router to reboot.


An HTTP smuggling attack in the web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote unauthenticated attacker to DoS the web application via sending a specific HTTP packet.


An issue was discovered in tcp_pulloutofband() in tcp_in.c in HCC embedded InterNiche 4.0.1. The TCP out-of-band urgent-data processing function invokes a panic function if the pointer to the end of the out-of-band data points outside of the TCP segment's data. If the panic function hadn't a trap invocation removed it will enter an infinite loop and therefore cause DoS (continuous loop or a device reset).


Frontier ichris through 5.18 mishandles making a DNS request for the hostname in the HTTP Host header as demonstrated by submitting 127.0.0.1 multiple times for DoS.


A denial-of-service vulnerability in Database Security (DBS) prior to 4.8.4 allows a remote authenticated administrator to trigger a denial-of-service attack against the DBS server. The configuration of Archiving through the User interface incorrectly allowed the creation of directories and files in Windows system directories and other locations where sensitive data could be overwritten. The former could lead to a DoS whilst the latter could lead to data destruction on the DBS server.


In the TeamCity IntelliJ plugin before 2020.2.2.85899 DoS was possible.


It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).


It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor and then press Enter or Space (in the Autolink plugin).


The ClamAV Engine (version 0.103.1 and below) component embedded in Storsmshield Network Security (SNS) is subject to DoS in case of parsing of malformed png files. This affect Netasq versions 9.1.0 to 9.1.11 and SNS versions 1.0.0 to 4.2.0. This issue is fixed in SNS 3.7.19 3.11.7 and 4.2.1.


Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin.


The issue was resolved with additional restrictions on CSS compositing. This issue is fixed in tvOS 15 watchOS 8 iOS 15 and iPadOS 15. Visiting a maliciously crafted website may reveal a user's browsing history.


An access issue was addressed with additional sandbox restrictions on third party applications. This issue is fixed in iOS 15 and iPadOS 15. A malicious application may be able to access some of the user's Apple ID information or recent in-app search terms.


A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8 macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.


An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 15.1 and iPadOS 15.1 macOS Monterey 12.0.1 iOS 14.8.1 and iPadOS 14.8.1 tvOS 15.1 watchOS 8.1 Security Update 2021-007 Catalina macOS Big Sur 11.6.1. Processing a maliciously crafted PDF may lead to arbitrary code execution.


Description: A cross-origin issue with iframe elements was addressed with improved tracking of security origins. This issue is fixed in tvOS 14.6 iOS 14.6 and iPadOS 14.6 Safari 14.1.1 macOS Big Sur 11.4 watchOS 7.5. Processing maliciously crafted web content may lead to universal cross site scripting.


This issue was addressed with improved environment sanitization. This issue is fixed in tvOS 14.6 iOS 14.6 and iPadOS 14.6 Security Update 2021-004 Catalina Security Update 2021-005 Mojave macOS Big Sur 11.4 watchOS 7.5. A malicious application may be able to break out of its sandbox.


An information leakage issue was addressed. This issue is fixed in iOS 15.1 and iPadOS 15.1 macOS Monterey 12.0.1 iOS 14.8.1 and iPadOS 14.8.1 tvOS 15.1 watchOS 8.1. A malicious website using Content Security Policy reports may be able to leak information via redirect behavior .


Description: A permissions issue was addressed with improved validation. This issue is fixed in iOS 15.2 and iPadOS 15.2. A local attacker may be able to read sensitive information.


A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in Security Update 2021-005 Catalina iOS 14.8 and iPadOS 14.8 iOS 15 and iPadOS 15 watchOS 8 macOS Big Sur 11.6. An application may be able to access restricted files.