A window management issue was addressed with improved state management. This issue is fixed in iOS 14.6 and iPadOS 14.6. A user may be able to view restricted content from the lockscreen.


A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in Security Update 2021-004 Mojave iOS 14.6 and iPadOS 14.6 Security Update 2021-003 Catalina macOS Big Sur 11.4 watchOS 7.5. A malicious application may be able to gain root privileges.


A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.2 macOS Monterey 12.1 Safari 15.2 iOS 15.2 and iPadOS 15.2 watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.


An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 14.5 and iPadOS 14.5 watchOS 7.4 Security Update 2021-003 Catalina tvOS 14.5 macOS Big Sur 11.3. Processing a maliciously crafted image may lead to arbitrary code execution.


This issue was addressed with improved checks. This issue is fixed in tvOS 14.6 iOS 14.6 and iPadOS 14.6 Security Update 2021-003 Catalina macOS Big Sur 11.4 watchOS 7.5. Parsing a maliciously crafted audio file may lead to disclosure of user information.


An inherited permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.1 watchOS 8.3 iOS 15.2 and iPadOS 15.2. A malicious application may be able to bypass Privacy preferences.


This issue was addressed with improved checks. This issue is fixed in watchOS 8 macOS Big Sur 11.6 Security Update 2021-005 Catalina tvOS 15 iOS 15 and iPadOS 15 iTunes 12.12 for Windows. Processing a maliciously crafted image may lead to arbitrary code execution.


A validation issue related to hard link behavior was addressed with improved sandbox restrictions. This issue is fixed in macOS Big Sur 11.6.2 tvOS 15.2 macOS Monterey 12.1 Security Update 2021-008 Catalina iOS 15.2 and iPadOS 15.2 watchOS 8.3. A malicious application may be able to bypass certain Privacy preferences.


This issue was addressed with improved checks. This issue is fixed in iOS 14.8 and iPadOS 14.8 macOS Big Sur 11.6 Security Update 2021-005 Catalina tvOS 15 iOS 15 and iPadOS 15 watchOS 8. Processing a maliciously crafted dfont file may lead to arbitrary code execution.


A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.1 iOS 12.5.3 iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5 macOS Big Sur 11.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..


This issue was addressed with improved checks. This issue is fixed in tvOS 14.6 Security Update 2021-004 Mojave iOS 14.6 and iPadOS 14.6 Security Update 2021-003 Catalina macOS Big Sur 11.4 watchOS 7.5. Processing a maliciously crafted ASTC file may disclose memory contents.


A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.6.2 macOS Monterey 12.1 Security Update 2021-008 Catalina iOS 15.2 and iPadOS 15.2 watchOS 8.3. A local user may be able to modify protected parts of the file system.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.1 iOS 15.2 and iPadOS 15.2 macOS Big Sur 11.6.2 Security Update 2021-008 Catalina. Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution.


A local attacker may be able to view Now Playing information from the lock screen. This issue is fixed in macOS Big Sur 11.4 iOS 14.6 and iPadOS 14.6. A privacy issue in Now Playing was addressed with improved permissions.


A logic issue was addressed with improved state management. This issue is fixed in iOS 14.8 and iPadOS 14.8 tvOS 15 iOS 15 and iPadOS 15 watchOS 8 Security Update 2021-007 Catalina. Processing a malicious audio file may result in unexpected application termination or arbitrary code execution.


Clementine Music Player through 1.3.1 (when a GLib 2.0.0 DLL is used) is vulnerable to a Read Access Violation on Block Data Move affecting the MP3 file parsing functionality at memcpy+0x265. The vulnerability is triggered when the user opens a crafted MP3 file or loads a remote stream URL that is mishandled by Clementine. Attackers could exploit this issue to cause a crash (DoS) of the clementine.exe process or achieve arbitrary code execution in the context of the current logged-in Windows user.


Clementine Music Player through 1.3.1 is vulnerable to a User Mode Write Access Violation affecting the MP3 file parsing functionality at clementine+0x3aa207. The vulnerability is triggered when the user opens a crafted MP3 file or loads a remote stream URL that is mishandled by Clementine. Attackers could exploit this issue to cause a crash (DoS) of the clementine.exe process or achieve arbitrary code execution in the context of the current logged-in Windows user.


A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the AVRDL unpacking module component used in certain F-Secure products can crash while scanning a fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will result in Denial-of-Service (DoS) of the Anti-Virus engine.


The shtml.exe component of Microsoft FrontPage 2000 Server Extensions 1.1 allows remote attackers to determine the physical path of the server components by requesting an invalid URL whose name includes a standard DOS device name.


QEMU 0.9.0 allows local users of a Windows XP SP2 guest operating system to overwrite the TranslationBlock (code_gen_buffer) buffer and probably have unspecified other impacts related to an \overflow \ via certain Windows executable programs as demonstrated by qemu-dos.com.


** DISPUTED ** DOSBox 0.72 and earlier allows local users to obtain access to the filesystem on the host operating system via the mount command. NOTE: the researcher reports a vendor response stating that this is not a security problem.


Absolute path traversal vulnerability in a certain ActiveX control in PGPBBox.dll in EldoS SecureBlackbox (sbb) 5.1.0.112 allows remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the SaveToFile method. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


imagemagick 6.8.9.6 has remote DOS via infinite loop


Huawei

Quidway

Quidway

Quidway

Quidway

Quidway

Quidway

Quidway

enable

attackers

to

launch

DoS

attacks

by

crafting

and

sending

malformed

packets

to

these

vulnerable

products.


qpid-cpp: ACL policies only loaded if the acl-file option specified enabling DoS by consuming all available file descriptors


Multiple

vulnerabilities

exist

in

Juniper

Junos

J-Web

error

handling

that

may

lead

to

cross

site

scripting

(XSS)

issues

or

crash

the

J-Web

service

(DoS).

This

affects

Juniper

Junos

OS

before

before

before

before

before

before

before

before

before

before

before

and

before


Mumble: murmur-server has DoS due to malformed client query


Winny 2.0b7.1 and earlier does not properly process node information which has unspecified impact and remote attack vectors that might lead to use of the product's host for DDoS attacks.


Winny 2.0b7.1 and earlier does not properly process BBS information which has unspecified impact and remote attack vectors that might lead to use of the product's host for DDoS attacks.


The kernel in Microsoft Windows NT 3.1 through Windows 7 including Windows 2000 SP4 Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista Gold SP1 and SP2 and Windows Server 2008 Gold and SP2 when access to 16-bit applications is enabled on a 32-bit x86 platform does not properly validate certain BIOS calls which allows local users to gain privileges by crafting a VDM_TIB data structure in the Thread Environment Block (TEB) and then calling the NtVdmControl function to start the Windows Virtual DOS Machine (aka NTVDM) subsystem leading to improperly handled exceptions involving the #GP trap handler (nt!KiTrap0D) aka \Windows Kernel Exception Handler Vulnerability.\


The CSSLoaderImpl::DoSheetComplete function in layout/style/nsCSSLoader.cpp in Mozilla Firefox 3.0.x before 3.0.18 3.5.x before 3.5.8 and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 changes the case of certain strings in a stylesheet before adding this stylesheet to the XUL cache which might allow remote attackers to modify the browser's font and other CSS attributes and potentially disrupt rendering of a web page by forcing the browser to perform this erroneous stylesheet caching.


Multiple

PHP

remote

file

inclusion

vulnerabilities

in

openMairie

openCimetiere

when

is

enabled

allow

remote

attackers

to

execute

arbitrary

PHP

code

via

a

URL

in

the

parameter

to

autorisation.class.php

courrierautorisation.class.php

droit.class.php

profil.class.php

utils.class.php

cimetiere.class.php

defunt.class.php

emplacement.class.php

voie.class.php

collectivite.class.php

defunttransfert.class.php

entreprise.class.php

travaux.class.php

zone.class.php

courrier.class.php

dossier.class.php

plans.class.php

and

utilisateur.class.php

in

obj/.


Multiple

PHP

remote

file

inclusion

vulnerabilities

in

openMairie

openCourrier

and

beta

when

is

enabled

allow

remote

attackers

to

execute

arbitrary

PHP

code

via

a

URL

in

the

parameter

to

bible.class.php

dossier.class.php

service.class.php

collectivite.class.php

droit.class.php

tache.class.php

emetteur.class.php

utilisateur.class.php

courrier.recherche.tab.class.php

and

profil.class.php

in

obj/.

NOTE:

some

of

these

details

are

obtained

from

third

party

information.


Multiple

PHP

remote

file

inclusion

vulnerabilities

in

openMairie

Openregistrecil

when

is

enabled

allow

remote

attackers

to

execute

arbitrary

PHP

code

via

a

URL

in

the

parameter

to

collectivite.class.php

dossier.class.php

registre.class.php

droit.class.php

organisme.class.php

service.class.php

destinataire.class.php

profil.class.php

dispense.class.php

modificatif.class.php

reference.class.php

and

utilisateur.class.php

in

obj/.


The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14 10.0.0-M1 to 10.0.20 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection it does not protect against all risks associated with running over any untrusted network particularly DoS risks.


Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response covering the HTTP method request URI host and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`) which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port` those would be used instead of a call to `utils.parseHost()`.


Memory

leak

in

implementation

in

Linux

Kernel

allows

a

remote

attacker

to

DoS

a

host

by

making

it

go

out-of-memory

via

packets

of

type

or

We

recommend

upgrading

past

commit


A potential DoS vulnerability was discovered in Gitlab CE/EE versions 13.7 before 14.7.7 all versions starting from 14.8 before 14.8.5 all versions starting from 14.9 before 14.9.2 allowed an attacker to trigger high CPU usage via a special crafted input added in Issues Merge requests Milestones Snippets Wiki pages etc.


Uncontrolled Resource Consumption in GitHub repository causefx/organizr prior to 2.1.2000. This vulnerability can be abused by doing a DDoS attack for which genuine users will not able to access resources/applications.


A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 13.1 prior to 14.7.7 14.8.0 prior to 14.8.5 and 14.9.0 prior to 14.9.2. The api to update an asset as a link from a release had a regex check which caused exponential number of backtracks for certain user supplied values resulting in high CPU usage.


A memory leak was discovered in matio 1.5.21 and earlier in Mat_VarReadNextInfo5() in mat5.c via a crafted file. This issue can potentially result in DoS.


In H3C MagicR100 <=V100R005 the / Ajax / ajaxget interface can be accessed without authorization. It sends a large amount of data through ajaxmsg to carry out DOS attack.


When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420 430 it does not sufficiently validate the XML document accepted from an untrusted source which might result in arbitrary files retrieval from the server and in successful exploits of DoS.


A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the fsicapd component used in certain F-Secure products while scanning larger packages/fuzzed files consume too much memory eventually can crash the scanning engine. The exploit can be triggered remotely by an attacker.


In autofile Audio File Library 0.3.6 there exists one memory leak vulnerability in printfileinfo in printinfo.c which allows an attacker to leak sensitive information via a crafted file. The printfileinfo function calls the copyrightstring function to get data however it dosn't use zero bytes to truncate the data.


The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes which may lead to DoS attacks.


A memory consumption issue was addressed with improved memory handling. This issue is fixed in tvOS 15.4 iOS 15.4 and iPadOS 15.4 iTunes 12.12.3 for Windows watchOS 8.5 macOS Monterey 12.3. Processing a maliciously crafted image may lead to heap corruption.


In spring framework versions prior to 5.3.20+ 5.2.22+ and old unsupported versions applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.


<Issue Description> Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant which has the potential of exhausting system resources using a single session. This vulnerability exposes OAuth 2.0 Client applications only.


A logic issue was addressed with improved state management. This issue is fixed in iOS 15.3 and iPadOS 15.3 watchOS 8.4 tvOS 15.3 Safari 15.3 macOS Monterey 12.2. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

prevent content security from being enforced


The application framework has a common DoS vulnerability.Successful exploitation of this vulnerability may affect the availability.


An issue with app access to camera metadata was addressed with improved logic. This issue is fixed in iOS 15.4 and iPadOS 15.4. An app may be able to learn information about the current camera view before being granted camera access.


The GSMA authentication panel could be presented on the lock screen. The issue was resolved by requiring device unlock to interact with the GSMA authentication panel. This issue is fixed in iOS 15.4 and iPadOS 15.4. A person with physical access may be able to view and modify the carrier account information and settings from the lock screen.


A cross-origin issue in the IndexDB API was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3 watchOS 8.4 tvOS 15.3 Safari 15.3 macOS Monterey 12.2. A website may be able to track sensitive user information.


A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1 iOS 15.3.1 and iPadOS 15.3.1 Safari 15.3 (v. 16612.4.9.1.8 and 15612.4.9.1.8). Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..


A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 15.3 and iPadOS 15.3 watchOS 8.4 tvOS 15.3 Safari 15.3 macOS Monterey 12.2. Processing a maliciously crafted mail message may lead to running arbitrary javascript.


Description: A permissions issue was addressed with improved validation. This issue is fixed in watchOS 8.5 iOS 15.4 and iPadOS 15.4 macOS Big Sur 11.6.5 macOS Monterey 12.3. A person with physical access to a device may be able to use Siri to obtain some location information from the lock screen.


An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in iOS 15.3 and iPadOS 15.3 watchOS 8.4 tvOS 15.3 macOS Monterey 12.2 macOS Big Sur 11.6.3. An application may be able to access a user's files.


In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1 an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.


On BIG-IP AFM version 16.x before 16.1.0 15.1.x before 15.1.5 14.1.x before 14.1.4.5 and all versions of 13.1.x when global AFM SYN cookie protection (TCP Half Open flood vector) is activated in the AFM Device Dos or DOS profile certain types of TCP connections will fail. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.


A PV guest could DoS Xen while unmapping a grant To address XSA-380 reference counting was introduced for grant mappings for the case where a PV guest would have the IOMMU enabled. PV guests can request two forms of mappings. When both are in use for any individual mapping unmapping of such a mapping can be requested in two steps. The reference count for such a mapping would then mistakenly be decremented twice. Underflow of the counters gets detected resulting in the triggering of a hypervisor bug check.


A Insecure Temporary File vulnerability in cscreen of openSUSE Factory allows local attackers to cause DoS for cscreen and a system DoS for non-default systems. This issue affects: openSUSE Factory cscreen version 1.2-1.3 and prior versions.


graphql-go is a GraphQL server with a focus on ease of use. In versions prior to 1.3.0 there exists a DoS vulnerability that is possible due to a bug in the library that would allow an attacker with specifically designed queries to cause stack overflow panics. Any user with access to the GraphQL handler can send these queries and cause stack overflows. This in turn could potentially compromise the ability of the server to serve data to its users. The issue has been patched in version `v1.3.0`. The only known workaround for this issue is to disable the `graphql.MaxDepth` option from your schema which is not recommended.


The acl_group_override function in smbd/posix_acls.c in smbd in Samba 3.0.x before 3.0.35 3.1.x and 3.2.x before 3.2.13 and 3.3.x before 3.3.6 when dos filemode is enabled allows remote attackers to modify access control lists for files via vectors related to read access to uninitialized memory.


Insecure method vulnerability in the EasyGrid.SGCtrl.32 ActiveX control in EasyGrid.ocx 1.0.0.1 in AAA EasyGrid ActiveX 3.51 allows remote attackers to create and overwrite arbitrary files via the (1) DoSaveFile or (2) DoSaveHtmlFile method. NOTE: vector 1 could be leveraged for code execution by creating executable files in Startup folders or by accessing files using hcp:// URLs. NOTE: some of these details are obtained from third party information.


Postfix 1.1.11 and earlier allows remote attackers to use Postfix to conduct \bounce scans\ or DDos attacks of other hosts via an email address to the local host containing the target IP address and service name followed by a \!\ string which causes Postfix to attempt to use SMTP to communicate with the target on the associated port.


Kaspersky Antivirus (KAV) 4.0.9.0 does not detect viruses in files with MS-DOS device names in their filenames which allows local users to bypass virus protection as demonstrated using aux.vbs and aux.com.


Multiple GameSpy 3D 2.62 compatible gaming servers generate very large UDP responses to small requests which allows remote attackers to use the servers as an amplifier in DDoS attacks with spoofed UDP query packets as demonstrated using Battlefield 1942.


SCO UNIX System V/386 Release 3.2 and other SCO products installs the home directories (1) /tmp for the dos user and (2) /usr/tmp for the asg user which allows other users to gain access to those accounts since /tmp and /usr/tmp are world-writable.


The system configuration control (sysctl) facility in BSD based operating systems OpenBSD 2.2 and earlier and FreeBSD 2.2.5 and earlier does not properly restrict source routed packets even when the (1) dosourceroute or (2) forwarding variables are set which allows remote attackers to spoof TCP connections.


id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes triggering an endless loop allocating memory until an OOM condition is reached leading to denial-of-service (DoS).


The Virtual DOS Machine (VDM) subsystem of Microsoft Windows NT 4.0 Windows 2000 Windows XP and Windows Server 2003 allows local users to access kernel memory and gain privileges via a malicious program that modified some system structures in a way that is not properly validated by privileged operating system functions.


Sophos Small Business Suite 1.00 on Windows does not properly handle files whose names contain reserved MS-DOS device names such as (1) LPT1 (2) COM1 (3) AUX (4) CON or (5) PRN which can allow malicious code to bypass detection when it is installed copied or executed.


Verity Ultraseek before 5.2.2 allows remote attackers to obtain the full pathname of the document root via an MS-DOS device name in the web search option such as (1) NUL (2) CON (3) AUX (4) COM1 (5) COM2 and others.


A vulnerability in the Akamai Connect feature of Cisco Wide Area Application Services (WAAS) Appliances could allow an unauthenticated remote attacker to cause a denial-of-service (DoS) condition on an affected device. The vulnerability is due to certain file-handling inefficiencies of the affected system. An attacker could exploit this vulnerability by directing client systems to access a corrupted file that the client systems cannot decompress correctly. A successful exploit could allow the attacker to cause the affected device to crash or hang unexpectedly and result in a DoS condition that may require manual intervention to regain normal operating conditions. Cisco Bug IDs: CSCve82472.


The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop which can allow attackers to cause a DoS attack.


Denial-of-service (DoS) vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles. A remote attacker can use crafted HTTP/HTTPS requests to cause denial-of-service through management console application crashes.


In The Sleuth Kit (TSK) 4.4.2 opening a crafted disk image triggers infinite recursion in dos_load_ext_table() in tsk/vs/dos.c in libtskvs.a as demonstrated by mmls.


Node.js v4.0 through v4.8.3 all versions of v5.x v6.0 through v6.11.0 v7.0 through v7.10.0 and v8.0 through v8.1.3 was susceptible to hash flooding remote DoS attacks as the HashTable seed was constant across a given released version of Node.js. This was a result of building with V8 snapshots enabled by default which caused the initially randomized seed to be overwritten on startup.


FontForge 20161012 does not ensure a positive size in a weight vector memcpy call in readcfftopdict (parsettf.c) resulting in DoS via a crafted otf file.


In Puppet Enterprise 2017.1.x and 2017.2.1 using specially formatted strings with certain formatting characters as Classifier node group names or RBAC role display names causes errors effectively causing a DOS to the service. This was resolved in Puppet Enterprise 2017.2.2.


AC6005 with software V200R006C10 AC6605 with software V200R006C10 have a DoS Vulnerability. An attacker can send malformed packets to the device which causes the device memory leaks leading to DoS attacks.


The vibrator service in P9 Plus smart phones with software versions earlier before VIE-AL10C00B386 has DoS vulnerability. An attacker can tricks a user into installing a malicious application on the smart phone and send given parameter to smart phone vibrator service interface to crash the system.


Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop application used to connect to the device suffers from a stack overflow if more than 26 characters are passed to it as the Wi-Fi password. This application is installed on the device and an attacker who can provide the right payload can execute code on the user's system directly. Any breach of this system can allow an attacker to get access to all the data that the user has access too. The application uses a dynamic link library(DLL) called \avilib.dll\ which is used by the application to send binary packets to the device that allow to control the device. One such action that the DLL provides is change password in the function \sendchangepass\ which allows a user to change the Wi-Fi password on the device. This function calls a sub function \sub_75876EA0\ at address 0x7587857C. The function determines which action to execute based on the parameters sent to it. The \sendchangepass\ passes the datastring as the second argument which is the password we enter in the textbox and integer 2 as first argument. The rest of the 3 arguments are set to 0. The function \sub_75876EA0\ at address 0x75876F19 uses the first argument received and to determine which block to jump to. Since the argument passed is 2 it jumps to 0x7587718C and proceeds from there to address 0x758771C2 which calculates the length of the data string passed as the first parameter.This length and the first argument are then passed to the address 0x7587726F which calls a memmove function which uses a stack address as the destination where the password typed by us is passed as the source and length calculated above is passed as the number of bytes to copy which leads to a stack overflow.


Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the device has default Wi-Fi credentials that are exactly the same for every device. This device acts as an Endoscope camera that allows its users to use it in various industrial systems and settings car garages and also in some cases in the medical clinics to get access to areas that are difficult for a human being to reach. Any breach of this system can allow an attacker to get access to video feed and pictures viewed by that user and might allow them to get a foot hold in air gapped networks especially in case of nation critical infrastructure/industries.


Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop application used to connect to the device suffers from a stack overflow if more than 26 characters are passed to it as the Wi-Fi name. This application is installed on the device and an attacker who can provide the right payload can execute code on the user's system directly. Any breach of this system can allow an attacker to get access to all the data that the user has access too. The application uses a dynamic link library(DLL) called \avilib.dll\ which is used by the application to send binary packets to the device that allow to control the device. One such action that the DLL provides is change password in the function \sendchangename\ which allows a user to change the Wi-Fi name on the device. This function calls a sub function \sub_75876EA0\ at address 0x758784F8. The function determines which action to execute based on the parameters sent to it. The \sendchangename\ passes the datastring as the second argument which is the name we enter in the textbox and integer 1 as first argument. The rest of the 3 arguments are set to 0. The function \sub_75876EA0\ at address 0x75876F19 uses the first argument received and to determine which block to jump to. Since the argument passed is 1 it jumps to 0x75876F20 and proceeds from there to address 0x75876F56 which calculates the length of the data string passed as the first parameter. This length and the first argument are then passed to the address 0x75877001 which calls the memmove function which uses a stack address as the destination where the password typed by us is passed as the source and length calculated above is passed as the number of bytes to copy which leads to a stack overflow.


Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the device has Telnet functionality enabled by default. This device acts as an Endoscope camera that allows its users to use it in various industrial systems and settings car garages and also in some cases in the medical clinics to get access to areas that are difficult for a human being to reach. Any breach of this system can allow an attacker to get access to video feed and pictures viewed by that user and might allow them to get a foot hold in air gapped networks especially in case of nation critical infrastructure/industries.


Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that any malicious user connecting to the device can change the default SSID and password thereby denying the owner an access to his/her own device. This device acts as an Endoscope camera that allows its users to use it in various industrial systems and settings car garages and also in some cases in the medical clinics to get access to areas that are difficult for a human being to reach. Any breach of this system can allow an attacker to get access to video feed and pictures viewed by that user and might allow them to get a foot hold in air gapped networks especially in case of nation critical infrastructure/industries.


In libavformat/mov.c in FFmpeg 3.3.3 a DoS in read_tfra() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MOV file which claims a large \item_count\ field in the header but does not contain sufficient backing data is provided the loop would consume huge CPU and memory resources since there is no EOF check inside the loop.


In Xiph.Org libvorbis 1.3.5 an out-of-bounds array read vulnerability exists in the function mapping0_forward() in mapping0.c which may lead to DoS when operating on a crafted audio file with vorbis_analysis().


In libavformat/rmdec.c in FFmpeg 3.3.3 a DoS in ivr_read_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted IVR file which claims a large \len\ field in the header but does not contain sufficient backing data is provided the first type==4 loop would consume huge CPU resources since there is no EOF check inside the loop.


In libavformat/asfdec_f.c in FFmpeg 3.3.3 a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted ASF file which claims a large \ict\ field in the header but does not contain sufficient backing data is provided the for loop would consume huge CPU and memory resources since there is no EOF check inside the loop.


In libavformat/mvdec.c in FFmpeg 3.3.3 a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file which claims a large \nb_frames\ field in the header but does not contain sufficient backing data is provided the loop over the frames would consume huge CPU and memory resources since there is no EOF check inside the loop.


In FFmpeg 3.3.3 a DoS in cine_read_header() due to lack of an EOF check might cause huge CPU and memory consumption. When a crafted CINE file which claims a large \duration\ field in the header but does not contain sufficient backing data is provided the image-offset parsing loop would consume huge CPU and memory resources since there is no EOF check inside the loop.


In coders/ps.c in ImageMagick 7.0.7-0 Q16 a DoS in ReadPSImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file which claims a large \extent\ field in the header but does not contain sufficient backing data is provided the loop over \length\ would consume huge CPU resources since there is no EOF check inside the loop.


In FFmpeg 3.3.3 a DoS in asf_read_marker() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted ASF file which claims a large \name_len\ or \count\ field in the header but does not contain sufficient backing data is provided the loops over the name and markers would consume huge CPU and memory resources since there is no EOF check inside these loops.


In libsndfile 1.0.28 a divide-by-zero error exists in the function double64_init() in double64.c which may lead to DoS when playing a crafted audio file.


In coders/psd.c in ImageMagick 7.0.7-0 Q16 a DoS in ReadPSDLayersInternal() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file which claims a large \length\ field in the header but does not contain sufficient backing data is provided the loop over \length\ would consume huge CPU resources since there is no EOF check inside the loop.


In libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4 a DoS in mxf_read_index_entry_array() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted MXF file which claims a large \nb_index_entries\ field in the header but does not contain sufficient backing data is provided the loop would consume huge CPU resources since there is no EOF check inside the loop. Moreover this big loop can be invoked multiple times if there is more than one applicable data segment in the crafted MXF file.


In coders/xbm.c in ImageMagick 7.0.6-1 Q16 a DoS in ReadXBMImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted XBM file which claims large rows and columns fields in the header but does not contain sufficient backing data is provided the loop over the rows would consume huge CPU resources since there is no EOF check inside the loop.


In libavformat/nsvdec.c in FFmpeg 2.4 and 3.3.3 a DoS in nsv_parse_NSVf_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted NSV file which claims a large \table_entries_used\ field in the header but does not contain sufficient backing data is provided the loop over 'table_entries_used' would consume huge CPU resources since there is no EOF check inside the loop.


A domain cleanup issue was discovered in the C xenstore daemon (aka cxenstored) in Xen through 4.9.x. When shutting down a VM with a stubdomain a race in cxenstored may cause a double-free. The xenstored daemon may crash resulting in a DoS of any parts of the system relying on it (including domain creation / destruction ballooning device changes etc.).


In libavformat/rl2.c in FFmpeg 3.3.3 a DoS in rl2_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted RL2 file which claims a large \frame_count\ field in the header but does not contain sufficient backing data is provided the loops (for offset and size tables) would consume huge CPU and memory resources since there is no EOF check inside these loops.


An Improper Input Validation issue was discovered in Rockwell Automation MicroLogix 1100 controllers 1763-L16BWA 1763-L16AWA 1763-L16BBB and 1763-L16DWD. A remote unauthenticated attacker could send a single specially crafted Programmable Controller Communication Commands (PCCC) packet to the controller that could potentially cause the controller to enter a DoS condition.


There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2 6.0.0 to 6.2.0 and 7.0.0 with the TLS handshake. This issue can cause the server to coredump.


In Ceph a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library.


An issue was discovered in ytnef before 1.9.1. This is related to a patch described as \2 of 9. Infinite Loop / DoS in the TNEFFillMapi function in lib/ytnef.c.\


An issue was discovered in ImageMagick 6.9.7. Incorrect TGA files could trigger assertion failures thus leading to DoS.


An issue was discovered in Magick++ in ImageMagick 6.9.7. A specially crafted file creating a nested exception could lead to a memory leak (thus a DoS).


An attacker may be able to cause a denial-of-service (DoS) attack against the sshd component in F5 BIG-IP Enterprise Manager BIG-IQ and iWorkflow.


An issue was discovered in ImageMagick 6.9.7. A specially crafted webp file could lead to a file-descriptor leak in libmagickcore (thus a DoS).


In F5 BIG-IP LTM AAM AFM Analytics APM ASM DNS Edge Gateway GTM Link Controller PEM WebAccelerator software version 12.0.0 - 12.1.2 11.6.0 - 11.6.1 11.4.0 - 11.5.4 11.2.1 when ConfigSync is configured attackers on adjacent networks may be able to bypass the TLS protections usually used to encrypted and authenticate connections to mcpd. This vulnerability may allow remote attackers to cause a denial-of-service (DoS) attack via resource exhaustion.


In F5 BIG-IP LTM AAM AFM Analytics APM ASM DNS Edge Gateway GTM Link Controller PEM WebAccelerator and WebSafe software version 13.0.0 12.0.0 - 12.1.2 11.6.0 - 11.6.1 and 11.5.0 - 11.5.4 in some circumstances Traffic Management Microkernel (TMM) does not properly handle certain malformed TLS1.2 records which allows remote attackers to cause a denial-of-service (DoS) or possible remote command execution on the BIG-IP system.


In Apache Struts 2.5 to 2.5.14 the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.


Huawei CloudEngine 12800 V100R003C00 V100R005C00 V100R005C10 V100R006C00 CloudEngine 5800 V100R003C00 V100R005C00 V100R005C10 V100R006C00 CloudEngine 6800 V100R003C00 V100R005C00 V100R005C10 V100R006C00 CloudEngine 7800 V100R003C00 V100R005C00 V100R005C10 V100R006C00 have a memory leak vulnerability. An unauthenticated attacker may send specific Resource ReServation Protocol (RSVP) packets to the affected products. Due to not release the memory to handle the packets successful exploit will result in memory leak of the affected products and lead to a DoS condition.


XML

parser

in

Huawei

has

a

DOS

vulnerability.

An

attacker

may

craft

specific

XML

files

to

the

affected

products.

Due

to

not

check

the

specially

XML

file

and

to

parse

this

file

successful

exploit

will

result

in

DOS

attacks.


VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an unbounded memory allocation issue as it did not throttle the framebuffer updates sent to its client. If the client did not consume these updates VNC server allocates growing memory to hold onto this data. A malicious remote VNC client could use this flaw to cause DoS to the server host.


Huawei S5700 and S6700 with software of V200R005C00 have a DoS vulnerability due to insufficient validation of the Network Quality Analysis (NQA) packets. A remote attacker could exploit this vulnerability by sending malformed NQA packets to the target device. Successful exploitation could make the device restart.


Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V600R006C00; TE50 V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00; VP9660 V500R002C10 have an DoS vulnerability due to insufficient validation of the parameter when a putty comment key is loaded. An authenticated remote attacker can place a malformed putty key file in system when a system manager load the key an infinite loop happens which lead to reboot the system.


XML parser in Huawei DP300 V500R002C00; RP200 V500R002C00SPC200; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 has a DoS vulnerability. Due to not check the specially XML file enough an authenticated local attacker may craft specific XML files to the affected products and parse this file which cause to null pointer accessing and result in DoS attacks.


Some Huawei Firewall products USG2205BSR V300R001C10SPC600; USG2220BSR V300R001C00; USG5120BSR V300R001C00; USG5150BSR V300R001C00 have a DoS vulnerability in the IPSEC IKEv1 implementations of Huawei Firewall products. Due to improper handling of the malformed messages an attacker may sent crafted packets to the affected device to exploit these vulnerabilities. Successful exploit the vulnerability could lead to device deny of service.


In aubio 0.4.6 a divide-by-zero error exists in the function new_aubio_source_wavread() in source_wavread.c which may lead to DoS when playing a crafted audio file.


Huawei DP300 V500R002C00 have a DoS vulnerability due to the lack of validation when the malloc is called. An authenticated local attacker can craft specific XML files to the affected products and parse this file which result in DoS attacks.


Timergrp module in Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 have an DoS vulnerability due to insufficient validation of the parameter. An authenticated local attacker may call a special API with special parameter which cause an infinite loop. Successful exploit of this vulnerability can allow an attacker to launch DOS attack.


Backup

feature

of

SIP

module

in

Huawei

ViewPoint

eSpace

eSpace

has

an

overflow

vulnerability

when

the

module

process

a

specific

amount

of

state.

The

module

cannot

handle

it

causing

SIP

module

DoS.


Huawei Secospace AntiDDoS8000 V500R001C20SPC500 have a memory leak vulnerability due to memory don't be released when the system open some function. An attacker could exploit it to cause memory leak which may further lead to system exceptions.


Huawei

ViewPoint

and

ViewPoint

have

an

insufficient

validation

vulnerability.

Since

packet

validation

is

insufficient

an

unauthenticated

attacker

may

send

special

packets

to

exploit

the

vulnerability.

Successful

exploit

could

allow

the

attacker

to

send

malicious

packets

and

result

in

DOS

attacks.


In libsndfile 1.0.25 (fixed in 1.0.26) a divide-by-zero error exists in the function wav_w64_read_fmt_chunk() in wav_w64.c which may lead to DoS when playing a crafted audio file.


uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this uri-js uses a regular expression This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100% usage while uri-js is trying to validate if the supplied URL is valid or not. To check if you're vulnerable look for a call to `require(\uri-js\).parse()` where a user is able to send their own input. This affects uri-js 2.1.1 and earlier.


The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.


the web framework using ljharb's qs module older than v6.3.2 v6.2.3 v6.1.2 and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.


Linux foundation ONOS 1.9.0 is vulnerable to a DoS.


kittoframework kitto version 0.5.1 is vulnerable to memory exhaustion in the router resulting in DoS


phpMyAdmin 4.0 4.4 and 4.6 are vulnerable to a DOS weakness in the table editing functionality


phpMyAdmin 4.0 4.4. and 4.6 are vulnerable to a DOS attack in the replication status by using a specially crafted table name


User process can perform the kernel DOS in ashmem when doing cache maintenance operation in all Android releases(Android for MSM Firefox OS for MSM QRD Android) from CAF using the Linux kernel.


The Philips DoseWise Portal web-based application versions 1.1.7.333 and 2.1.1.3069 stores login credentials in clear text within backend system files. CVSS v3 base score: 6.5 CVSS vector string: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.


An issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3. By connecting to the Mosquitto broker on an access point and one of its clients an attacker can gather enough information to craft a command that reboots the client remotely when sent to the client's Mosquitto broker aka \unauthenticated remote command execution.\ This command can be re-sent endlessly to act as a DoS attack on the client.


The REST Plugin in Apache Struts 2.1.x 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.


When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33.


In curl before 7.54.1 on Windows and DOS libcurl's default protocol function which is the logic that allows an application to set which protocol libcurl should attempt to use when given a URL without a scheme part had a flaw that could lead to it overwriting a heap based memory buffer with seven bytes. If the default protocol is specified to be FILE or a file: URL lacks two slashes the given \URL\ starts with a drive letter and libcurl is built for Windows or DOS then libcurl would copy the path 7 bytes off so that the end of the given path would write beyond the malloc buffer (7 bytes being the length in bytes of the ascii string \file://\).


In Open vSwitch (OvS) 2.7.0 while parsing an OpenFlow role status message there is a call to the abort() function for undefined role status reasons in the function `ofp_print_role_status_message` in `lib/ofp-print.c` that may be leveraged toward a remote DoS attack by a malicious switch.


The backend database of the Philips DoseWise Portal application versions 1.1.7.333 and 2.1.1.3069 uses hard-coded credentials for a database account with privileges that can affect confidentiality integrity and availability of the database. For an attacker to exploit this vulnerability elevated privileges are first required for an attacker to access the web application backend system files that contain the hard-coded credentials. Successful exploitation may allow a remote attacker to gain access to the database of the DWP application which contains PHI. CVSS v3 base score: 9.1 CVSS vector string: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.


The Bastet of some Huawei mobile phones with software of earlier than MHA-AL00BC00B231 versions has a DOS vulnerability due to the lack of parameter validation. An attacker may trick a user into installing a malicious APP. The APP can modify specific parameter to cause system reboot.


The call module of P10 and P10 Plus smartphones with software versions before VTR-AL00C00B167 versions before VTR-TL00C01B167 versions before VKY-AL00C00B167 versions before VKY-TL00C01B167 has a DoS vulnerability. An attacker may trick a user into installing a malicious application and the application can send given parameter to call module to crash the call and data communication process.


Huawei firewall products USG9500 V500R001C50 has a DoS vulnerability.A remote attacker who controls the peer device could exploit the vulnerability by sending malformed IKE packets to the target device. Successful exploit of the vulnerability could cause the device to restart.


The NFSv4 server in the Linux kernel before 4.11.3 does not properly validate the layout type when processing the NFSv4 pNFS GETDEVICEINFO or LAYOUTGET operand in a UDP packet from a remote attacker. This type value is uninitialized upon encountering certain error conditions. This value is used as an array index for dereferencing which leads to an OOPS and eventually a DoS of knfsd and a soft-lockup of the whole system.


with

software

with

software

with

software

with

software

with

software

with

software

with

software

with

software

with

software

with

software

with

software

with

software

with

software

with

software

with

software

with

software

with

software

have

a

DoS

vulnerability.

Due

to

incorrect

malformed

message

processing

logic

an

authenticated

remote

attacker

could

send

specially

crafted

message

to

the

target

device.Successful

exploit

of

the

vulnerability

could

cause

stack

overflow

and

make

a

service

unavailable.


Wi-Fi driver of Honor 5C and P9 Lite Huawei smart phones with software versions earlier than NEM-L21C432B351 and versions earlier than VNS-L21C10B381 has a DoS vulnerability. An attacker may trick a user into installing a malicious application and the application can access invalid address of driver to crash the system.


with

software

with

software

CloudEngine

with

software

CloudEngine

with

software

CloudEngine

with

software

CloudEngine

with

software

CloudEngine

with

software

with

software

with

software

with

software

with

software

with

software

with

software

with

software

with

software

with

software

with

software

with

software

Secospace

have

a

MaxAge

LSA

vulnerability

due

to

improper

OSPF

implementation.

When

the

device

receives

special

LSA

packets

the

LS

(Link

Status)

age

would

be

set

to

MaxAge

seconds.

An

attacker

can

exploit

this

vulnerability

to

poison

the

route

table

and

launch

a

DoS

attack.


SWFTools

on

Windows

has

a

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

image00000000_00400000+0x0000000000003e71\

issue.

This

issue

can

be

triggered

by

a

malformed

TTF

file

that

is

mishandled

by

Attackers

could

exploit

this

issue

for

DoS

(Access

Violation).


FastStone Image Viewer 6.2 has a \User Mode Write AV\ issue possibly related to the jpeg_mem_term function in jmemnobs.c in libjpeg. This issue can be triggered by a malformed JPEG file that is mishandled by FSViewer.exe. Attackers could exploit this issue for DoS (Access Violation) or possibly unspecified other impact.


Dropbox Lepton 1.2.1 allows DoS (SEGV and application crash) via a malformed lepton file because the code does not ensure setup of a correct number of threads.


TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow DoSing the HTTP server via a crafted Cookie header to the /cgi/ansi URI.


In SWFTools 0.9.2 an out-of-bounds write of heap data can occur in the function png_load() in lib/png.c:755. This issue can be triggered by a malformed PNG file that is mishandled by png2swf. Attackers could exploit this issue for DoS; it might cause arbitrary code execution.


FastStone Image Viewer 6.2 has a \Data from Faulting Address may be used as a return value\ issue. This issue can be triggered by a malformed JPEG 2000 file that is mishandled by FSViewer.exe. Attackers could exploit this issue for DoS (Access Violation) or possibly unspecified other impact.


libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD) which allows local users to obtain sensitive information via a process listing.


Microsoft Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 do not properly constrain impersonation levels which allows local users to gain privileges via a crafted application aka \Windows MS-DOS Device Name Vulnerability.\


QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It occurs when a guest sends a Layer-2 packet smaller than 22 bytes. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulting in DoS.


QEMU (aka Quick Emulator) built to use 'address_space_translate' to map an address to a MemoryRegionSection is vulnerable to an OOB r/w access issue. It could occur while doing pci_dma_read/write calls. Affects QEMU versions >= 1.6.0 and <= 2.3.1. A privileged user inside guest could use this flaw to crash the guest instance resulting in DoS.


QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It could occur while reading Interrupt Mask Registers (IMR). A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulting in DoS.


QEMU (aka Quick Emulator) built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmit (tx) descriptors in 'tx_consume' routine if a descriptor was to have more than allowed (ROCKER_TX_FRAGS_MAX=16) fragments. A privileged user inside guest could use this flaw to cause memory leakage on the host or crash the QEMU process instance resulting in DoS issue.


** DISPUTED ** Tor before 0.1.1.20 kills the circuit when it receives an unrecognized relay command which causes network circuits to be disbanded. NOTE: while this item is listed under the \Security fixes\ section of the developer changelog the developer clarified on 20060707 that this is only a self-DoS. Therefore this issue should not be included in CVE.


The RtlDosPathNameToNtPathName_U API function in NTDLL.DLL in Microsoft Windows 2000 SP4 and XP SP2 does not properly convert DOS style paths with trailing spaces into NT style paths which allows context-dependent attackers to create files that cannot be accessed through the expected DOS path or prevent access to other similarly named files in the same directory which prevents those files from being detected or disinfected by certain anti-virus and anti-spyware software.


The VDM (Virtual DOS Machine) emulation environment for MS-DOS applications in Windows 2000 Windows XP SP2 and Windows Server 2003 allows local users to read the first megabyte of memory and possibly obtain sensitive information as demonstrated by dumper.asm.


QNX 2.4 allows a local user to read arbitrary files by directly accessing the mount point for the FAT disk partition e.g. /fs-dos.


Perception LiteServe 1.25 allows remote attackers to obtain source code of CGI scripts via URLs that contain MS-DOS conventions such as (1) upper case letters or (2) 8.3 file names.


VMware ESXi 3.5 4.0 and 4.1 and ESX 3.5 4.0 and 4.1 do not properly implement port-based I/O operations which allows guest OS users to gain guest OS privileges by overwriting memory locations in a read-only memory block associated with the Virtual DOS Machine.


Hash collision attack vulnerability in Jenkins before 1.447 Jenkins LTS before 1.424.2 and Jenkins Enterprise by CloudBees 1.424.x before 1.424.2.1 and 1.400.x before 1.400.0.11 could allow remote attackers to cause a considerable CPU load aka \the Hash DoS attack.\


InfoSphere Guardium aix_ktap module: DoS


mono 2.10.x ASP.NET Web Form Hash collision DoS


IBM WebSphere MQ 7.1 and 7.5: Queue manager has a DoS vulnerability


openslp: SLPIntersectStringList()' Function has a DoS vulnerability


Corel WordPerfect Office X6 16.0.0.388 has a DoS Vulnerability via untrusted pointer dereference


quagga (ospf6d) 0.99.21 has a DoS flaw in the way the ospf6d daemon performs routes removal


The

App.Undo.UndoSupport.get_request_var_or_attr

function

in

Zope

before

and

before

as

used

in

Plone

before

and

before

beta

allows

remote

authenticated

users

to

gain

access

to

restricted

attributes

via

unspecified

vectors.


thttpd has a local DoS vulnerability via specially-crafted .htpasswd files


FFmpeg

before

commit

contains

an

out

of

array

access

vulnerability

in

MXF

format

demuxer

that

can

result

in

DoS.

This

attack

appear

to

be

exploitable

via

specially

crafted

MXF

file

which

has

to

be

provided

as

input.

This

vulnerability

appears

to

have

been

fixed

in

and

later.


An issue was discovered on Sigma Design Z-Wave S0 through S2 devices. An attacker first prepares a Z-Wave frame-transmission program (e.g. Z-Wave PC Controller OpenZWave CC1110 etc.). Next the attacker conducts a DoS attack against the Z-Wave S0 Security version product by continuously sending divided \Nonce Get (0x98 0x81)\ frames. The reason for dividing the \Nonce Get\ frame is that in security version S0 when a node receives a \Nonce Get\ frame the node produces a random new nonce and sends it to the Src node of the received \Nonce Get\ frame. After the nonce value is generated and transmitted the node transitions to wait mode. At this time when \Nonce Get\ is received again the node discards the previous nonce value and generates a random nonce again. Therefore because the frame is encrypted with previous nonce value the received normal frame cannot be decrypted.


admin\\db\\DoSql.php in EmpireCMS through 7.5 allows remote attackers to execute arbitrary PHP code via SQL injection that uses a .php filename in a SELECT INTO OUTFILE statement to admin/admin.php.


Netwide Assembler (NASM) through 2.14rc16 has memory leaks that may lead to DoS related to nasm_malloc in nasmlib/malloc.c.


admin\\db\\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php.


By specially crafting HTTP requests the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33).


An issue was discovered in ASUSWRT 3.0.0.4.384.20308. An unauthenticated user can trigger a DoS of the httpd service via the /APP_Installation.asp?= URI.


In function SMF_ParseMetaEvent of file eas_smf.c there is incorrect input validation causing an infinite loop. This could lead to a remote temporary DoS with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-68664359


An issue was discovered on AXIS M1033-W (IP camera) Firmware version 5.40.5.1 devices. They don't employ a suitable mechanism to prevent a DoS attack which leads to a response time delay. An attacker can use the hping3 tool to perform an IPv4 flood attack and the services are interrupted from attack start to end.


A crash can occur when processing a crafted S/MIME message or an XPI package containing a crafted signature. This can be used as a denial-of-service (DOS) attack because Thunderbird reopens the last seen message on restart triggering the crash again. This vulnerability affects Thunderbird < 60.5.


D-Link DCS-825L devices with firmware 1.08 do not employ a suitable mechanism to prevent denial-of-service (DoS) attacks. An attacker can harm the device availability (i.e. live-online video/audio streaming) by using the hping3 tool to perform an IPv4 flood attack. Verified attacks includes SYN flooding UDP flooding ICMP flooding and SYN-ACK flooding.


`memjs` versions <= 1.1.0 allocates and stores buffers on typed input resulting in DoS and uninitialized memory usage.


https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).


A External Entity Reference ('XXE') vulnerability in SUSE Linux SMT allows remote attackers to read data from the server or cause DoS by referencing blocking elements. Affected releases are SUSE Linux SMT: versions prior to 3.0.37.


Lack of an authentication mechanism in KERUI Wifi Endoscope Camera (YPC99) allows an attacker to watch or block the camera stream. The RTSP server on port 7070 accepts the command STOP to stop streaming and the command SETSSID to disconnect a user.


An issue was discovered in CmsEasy 6.1_20180508. There is a CSRF vulnerability in the rich text editor that can add an IFRAME element. This might be used in a DoS attack if a referenced remote URL is refreshed at a rapid rate.


FastStone Image Viewer 6.2 has a User Mode Read and Execute AV at 0x0057898e triggered when the user opens a malformed JPEG file that is mishandled by FSViewer.exe. Attackers could exploit this issue for DoS (Access Violation) or possibly unspecified other impact.


An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordPress. Any logged in user can launch Mass Pages/Posts creation with custom content. There is no nonce or user capability check so anyone can launch a DoS attack against a site and create hundreds of thousands of posts with custom content.


In Dedos-web 1.0 the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on GitHub. An attacker can edit the contents of the session cookie and re-sign it using the hardcoded secret. Due to the use of Passport.js this could lead to privilege escalation.


An issue was discovered in the America's Army Proving Grounds platform for the Unreal Engine. With a false packet sent via UDP the application server responds with several bytes giving the possibility of DoS amplification even being able to be used in DDoS attacks.


In CMS Made Simple (CMSMS) through 2.2.7 the \file delete\ operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS exploitable by an admin user because the attacker can remove all lib/ files in all directories.


A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation processor does not deliver interrupts and exceptions they are delivered once the first instruction after the stack switch is executed. An unprivileged system user could use this flaw to crash the system kernel resulting in DoS. This CVE-2018-10872 was assigned due to regression of CVE-2018-8897 in Red Hat Enterprise Linux 6.10 GA kernel. No other versions are affected by this CVE.


In CMS Made Simple (CMSMS) through 2.2.7 the \module remove\ operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS exploitable by an admin user because the attacker can remove all lib/ files in all directories.


Cloud Foundry Garden-runC versions prior to 1.13.0 does not correctly enforce disc quotas for Docker image layers. A remote authenticated user may push an app with a malicious Docker image that will consume more space on a Diego cell than allocated in their quota potentially causing a DoS against the cell.


The

Apache

Struts

REST

Plugin

is

using

XStream

library

which

is

vulnerable

and

allow

perform

a

DoS

attack

when

using

a

malicious

request

with

specially

crafted

XML

payload.

Upgrade

to

the

Apache

Struts

version

and

switch

to

an

optional

Jackson

XML

handler

as

described

here

Another

option

is

to

implement

a

custom

XML

handler

based

on

the

Jackson

XML

handler

from

the

Apache

Struts


An issue was discovered in Moodle 3.x. By substituting URLs in portfolios users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack.


Artifex Mupdf version 1.12.0 contains a Use After Free vulnerability in fz_keep_key_storable that can result in DOS / Possible code execution. This attack appear to be exploitable via Victim opens a specially crafted PDF.


libarchive

version

commit

onwards

(release

onwards)

contains

a

Double

Free

vulnerability

in

RAR

decoder

libarchive/archive_read_support_format_rar.c

realloc(rar->lzss.window

with

that

can

result

in

Crash/DoS.

This

attack

appear

to

be

exploitable

via

the

victim

must

open

a

specially

crafted

RAR

archive.


GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13 libtasn1-4.12 contains a DoS specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree) after a long time the program will be killed. This attack appears to be exploitable via parsing a crafted file.


Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.


OpenKMIP PyKMIP version All versions before 0.8.0 contains a CWE 399: Resource Management Errors (similar issue to CVE-2015-5262) vulnerability in PyKMIP server that can result in DOS: the server can be made unavailable by one or more clients opening all of the available sockets. This attack appear to be exploitable via A client or clients open sockets with the server and then never close them. This vulnerability appears to have been fixed in 0.8.0.


libarchive

version

commit

onwards

(release

onwards)

contains

a

Use

After

Free

vulnerability

in

RAR

decoder

that

can

result

in

Crash/DoS

it

is

unknown

if

RCE

is

possible.

This

attack

appear

to

be

exploitable

via

the

victim

must

open

a

specially

crafted

RAR

archive.


beep version 1.3 and up contains a External Control of File Name or Path vulnerability in --device option that can result in Local unprivileged user can inhibit execution of arbitrary programs by other users allowing DoS. This attack appear to be exploitable via The system must allow local users to run beep.


libarchive

version

commit

onwards

(release

onwards)

contains

a

Improper

Input

Validation

vulnerability

in

WARC

parser

libarchive/archive_read_support_format_warc.c

that

can

result

in

DoS

quasi-infinite

run

time

and

disk

usage

from

tiny

file.

This

attack

appear

to

be

exploitable

via

the

victim

must

open

a

specially

crafted

WARC

file.


An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can send a reply in which the first string overflows causing a variable to be set to NULL that will be freed later on leading to DoS (segmentation fault).


An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-one error caused by malicious server responses leading to DoS or possibly unspecified other impact.


On BIG-IP 14.0.0-14.0.0.2 13.0.0-13.1.0.7 12.1.0-12.1.3.5 11.6.0-11.6.3.2 or 11.2.1-11.5.6 BIG-IQ Centralized Management 6.0.0-6.0.1 5.0.0-5.4.0 or 4.6.0 BIG-IQ Cloud and Orchestration 1.0.0 iWorkflow 2.0.1-2.3.0 or Enterprise Manager 3.1.1 a BIG-IP user granted with tmsh access may cause the BIG-IP system to experience denial-of-service (DoS) when the BIG-IP user uses the tmsh utility to run the edit cli preference command and proceeds to save the changes to another filename repeatedly. This action utilises storage space on the /var partition and when performed repeatedly causes the /var partition to be full.


An issue was discovered in Xen through 4.11.x. The logic in oxenstored for handling writes depended on the order of evaluation of expressions making up a tuple. As indicated in section 7.7.3 \Operations on data structures\ of the OCaml manual the order of evaluation of subexpressions is not specified. In practice different implementations behave differently. Thus oxenstored may not enforce the configured quota-maxentity. This allows a malicious or buggy guest to write as many xenstore entries as it wishes causing unbounded memory usage in oxenstored. This can lead to a system-wide DoS.


Certain input files could make the code hang when Apache Sanselan 0.97-incubator was used to parse them which could be used in a DoS attack. Note that Apache Sanselan (incubating) was renamed to Apache Commons Imaging.


Certain input files could make the code to enter into an infinite loop when Apache Sanselan 0.97-incubator was used to parse them which could be used in a DoS attack. Note that Apache Sanselan (incubating) was renamed to Apache Commons Imaging.


An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.


SBLIM Small Footprint CIM Broker (SFCB) 1.4.9 has a null pointer (DoS) vulnerability via a crafted POST request to the /cimom URI.


Loop with Unreachable Exit Condition ('Infinite Loop') in McAfee GetSusp (GetSusp) 3.0.0.461 and earlier allows attackers to DoS a manual GetSusp scan via while scanning a specifically crafted file . GetSusp is a free standalone McAfee tool that runs on several versions of Microsoft Windows.


An issue was discovered in CImg v.220. DoS occurs when loading a crafted bmp image that triggers an allocation failure in load_bmp in CImg.h.


Huawei AR1200 V200R006C10SPC300 AR160 V200R006C10SPC300 AR200 V200R006C10SPC300 AR2200 V200R006C10SPC300 AR3200 V200R006C10SPC300 devices have an improper resource management vulnerability. Due to the improper implementation of ACL mechanism a remote attacker may send TCP messages to the management interface of the affected device to exploit this vulnerability. Successful exploit could exhaust the socket resource of management interface leading to a DoS condition.


A prototype pollution attack in cached-path-relative versions <=1.0.1 allows an attacker to inject properties on Object.prototype which are then inherited by all the JS objects through the prototype chain causing a DoS attack.


In Poppler 0.68.0 the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack.


A flaw was found in qemu Media Transfer Protocol (MTP) before version 3.1.0. A path traversal in the in usb_mtp_write_data function in hw/usb/dev-mtp.c due to an improper filename sanitization. When the guest device is mounted in read-write mode this allows to read/write arbitrary files which may lead do DoS scenario OR possibly lead to code execution on the host.


A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages() in case of an error while processing posted interrupt address it unmaps the 'pi_desc_page' without resetting 'pi_desc' descriptor address which is later used in pi_test_and_clear_on(). A guest user/process could use this flaw to crash the host kernel resulting in DoS or potentially gain privileged access to a system. Kernel versions before 4.14.91 and before 4.19.13 are vulnerable.


An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process.


There

is

a

XML

external

entity

(XXE)

vulnerability

in

halo

The

function

of

importing

other

blogs

in

the

background(/api/admin/migrations/wordpress)

needs

to

parse

the

xml

file

but

it

is

not

used

for

security

defense

This

vulnerability

can

detect

the

intranet

read

files

enable

ddos

attacks

etc.


A

memory

leak

in

Openthread's

wpantund

versions

up

to

commit

when

used

in

an

environment

where

wpanctl

is

directly

interfacing

with

the

control

driver

(eg:

debug

environments)

can

allow

an

attacker

to

crash

the

service

(DoS).

We

recommend

updating

or

to

restrict

access

in

your

debug

environments.


Prototype pollution in json-bigint npm package < 1.0.0 may lead to a denial-of-service (DoS) attack.


A certificate validation issue existed when processing administrator added certificates. This issue was addressed with improved certificate validation. This issue is fixed in iOS 13.6 and iPadOS 13.6 macOS Catalina 10.15.6 tvOS 13.4.8 watchOS 6.2.8. An attacker may have been able to impersonate a trusted website using shared key material for an administrator added certificate.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5 macOS Catalina 10.15.5 tvOS 13.4.5 watchOS 6.2.5 iTunes 12.10.7 for Windows iCloud for Windows 11.2 iCloud for Windows 7.19. Processing a maliciously crafted image may lead to arbitrary code execution.


A logic issue was addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6 tvOS 13.4.8 watchOS 6.2.8 Safari 13.1.2 iTunes 12.10.8 for Windows iCloud for Windows 11.3 iCloud for Windows 7.20. Processing maliciously crafted web content may lead to universal cross site scripting.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6 macOS Catalina 10.15.6 tvOS 13.4.8 watchOS 6.2.8 iTunes 12.10.8 for Windows iCloud for Windows 11.3 iCloud for Windows 7.20. Processing a maliciously crafted image may lead to arbitrary code execution.


Multiple issues were addressed with improved logic. This issue is fixed in iOS 13.6 and iPadOS 13.6 tvOS 13.4.8 watchOS 6.2.8 Safari 13.1.2 iTunes 12.10.8 for Windows iCloud for Windows 11.3 iCloud for Windows 7.20. A malicious attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.


There is a Missing Cryptographic Step vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause DoS of Samgr.


A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5 tvOS 13.4.5 watchOS 6.2.5 Safari 13.1.1 iTunes 12.10.7 for Windows iCloud for Windows 11.2 iCloud for Windows 7.19. Processing maliciously crafted web content may lead to arbitrary code execution.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6 macOS Catalina 10.15.6 tvOS 13.4.8 watchOS 6.2.8. Processing a maliciously crafted audio file may lead to arbitrary code execution.


A use after free issue was addressed with improved memory management. This issue is fixed in iOS 13.6 and iPadOS 13.6 tvOS 13.4.8 watchOS 6.2.8 Safari 13.1.2 iTunes 12.10.8 for Windows iCloud for Windows 11.3 iCloud for Windows 7.20. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.


An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in iOS 13.6 and iPadOS 13.6 macOS Catalina 10.15.6 tvOS 13.4.8 watchOS 6.2.8. A local attacker may be able to elevate their privileges.


A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5 tvOS 13.4.5 watchOS 6.2.5 Safari 13.1.1 iTunes 12.10.7 for Windows iCloud for Windows 11.2 iCloud for Windows 7.19. A remote attacker may be able to cause arbitrary code execution.


The issue was resolved by clearing application previews when content is deleted. This issue is fixed in iOS 13.4 and iPadOS 13.4. A local user may be able to view deleted content in the app switcher.


An input validation issue was addressed with improved input validation. This issue is fixed in iOS 14.0 and iPadOS 14.0 tvOS 14.0 watchOS 7.0 Safari 14.0 iCloud for Windows 11.4 iCloud for Windows 7.21. Processing maliciously crafted web content may lead to a cross site scripting attack.


An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in iOS 13.6 and iPadOS 13.6 macOS Catalina 10.15.6 tvOS 13.4.8. A local attacker may be able to elevate their privileges.


An access issue existed in Content Security Policy. This issue was addressed with improved access restrictions. This issue is fixed in iOS 13.6 and iPadOS 13.6 tvOS 13.4.8 watchOS 6.2.8 Safari 13.1.2 iTunes 12.10.8 for Windows iCloud for Windows 11.3 iCloud for Windows 7.20. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.


A double free issue was addressed with improved memory management. This issue is fixed in iOS 13.5 and iPadOS 13.5 macOS Catalina 10.15.5. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.


A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5 and iPadOS 13.5 iOS 12.4.7 watchOS 6.2.5 watchOS 5.3.7. Processing a maliciously crafted mail message may lead to heap corruption.


A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5 tvOS 13.4.5 watchOS 6.2.5 Safari 13.1.1 iTunes 12.10.7 for Windows iCloud for Windows 11.2 iCloud for Windows 7.19. Processing maliciously crafted web content may lead to universal cross site scripting.


A use after free issue was addressed with improved memory management. This issue is fixed in iOS 13.6 and iPadOS 13.6 tvOS 13.4.8 watchOS 6.2.8 iCloud for Windows 7.20 macOS Catalina 10.15.6 Security Update 2020-004 Mojave Security Update 2020-004 High Sierra. Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution.


An entitlement parsing issue was addressed with improved parsing. This issue is fixed in iOS 13.5 and iPadOS 13.5 macOS Catalina 10.15.5 tvOS 13.4.5 watchOS 6.2.5. A malicious application could interact with system processes to access private information and perform privileged actions.


XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS ADS-Lite) versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1 9.0.2 9.0.3 9.0.5 9.0.6; Metasys Network Integration Engine (NIE55/NIE59) versions 9.0.1 9.0.2 9.0.3 9.0.5 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke Control Network Automation Engine (NAE55 UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6 macOS Catalina 10.15.6 tvOS 13.4.8 watchOS 6.2.8 iTunes 12.10.8 for Windows iCloud for Windows 11.3 iCloud for Windows 7.20. Processing a maliciously crafted image may lead to arbitrary code execution.


A use after free issue was addressed with improved memory management. This issue is fixed in iOS 13.4 and iPadOS 13.4 tvOS 13.4 Safari 13.1 iTunes for Windows 12.10.5 iCloud for Windows 10.9.3 iCloud for Windows 7.18. Processing maliciously crafted web content may lead to code execution.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5 iOS 12.4.7 watchOS 6.2.5. Processing a maliciously crafted mail message may lead to unexpected memory modification or application termination.


This issue was addressed with improved setting propagation. This issue is fixed in macOS Big Sur 11.0.1 tvOS 14.0 macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave watchOS 7.0 iOS 14.0 and iPadOS 14.0. An attacker in a privileged network position may be able to unexpectedly alter application state.


A memory buffer error vulnerability exists in a component interface of Huawei Smartphone. Local attackers can exploit this vulnerability to cause memory leakage and doS attacks by carefully constructing attack scenarios.


A Server-Side Request Forgery (SSRF) affecting the PDF generation in MicroStrategy 10.4 2019 before Update 6 and 2020 before Update 2 allows authenticated users to access the content of internal network resources or leak files from the local system via HTML containers embedded in a dossier/dashboard document. NOTE: 10.4. no fix will be released as version will reach end-of-life on 31/12/2020.


An unauthenticated specially crafted packet sent by an attacker over the network will cause a denial-of-service (DoS) vulnerability. Vulnerability allows attacker to stop the PLC. After stopping (ERR LED flashing red) physical access to the PLC is required in order to restart the application. This issue affects: ABB AC500 V2 products with onboard Ethernet version 2.8.4 and prior versions.


An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges the creation of the system.data file is prone to symlink attacks. The tss user can be used to create or corrupt existing files which could possibly lead to a DoS attack.


In FreeBSD 12.2-STABLE before r368969 11.4-STABLE before r369047 12.2-RELEASE before p3 12.1-RELEASE before p13 and 11.4-RELEASE before p7 msdosfs(5) was failing to zero-fill a pair of padding fields in the dirent structure resulting in a leak of three uninitialized bytes.


A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave macOS Big Sur 11.0.1 iOS 14.2 and iPadOS 14.2 watchOS 7.1 tvOS 14.2. Processing maliciously crafted web content may lead to code execution.


A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.0.1 watchOS 7.1 iOS 14.2 and iPadOS 14.2 iCloud for Windows 11.5 Safari 14.0.1 tvOS 14.2 iTunes 12.11 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.


Multiple issues were addressed with improved logic. This issue is fixed in iOS 14.2 and iPadOS 14.2 macOS Big Sur 11.0.1 watchOS 7.1 tvOS 14.2. A sandboxed process may be able to circumvent sandbox restrictions.


An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1 watchOS 7.1 iOS 14.2 and iPadOS 14.2 iCloud for Windows 11.5 tvOS 14.2 iTunes 12.11 for Windows. Processing a maliciously crafted image may lead to arbitrary code execution.


An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave macOS Big Sur 11.0.1 iOS 14.2 and iPadOS 14.2 watchOS 7.1 tvOS 14.2. Processing a maliciously crafted image may lead to arbitrary code execution.


In Eclipse Californium version 2.3.0 to 2.6.0 the certificate based (x509 and RPK) DTLS handshakes accidentally fails because the DTLS server side sticks to a wrong internal state. That wrong internal state is set by a previous certificate based DTLS handshake failure with TLS parameter mismatch. The DTLS server side must be restarted to recover this. This allow clients to force a DoS.


A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave macOS Big Sur 11.0.1 iOS 14.2 and iPadOS 14.2 watchOS 7.1 tvOS 14.2. Processing a maliciously crafted font file may lead to arbitrary code execution.


A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.0.1 watchOS 7.1 iOS 14.2 and iPadOS 14.2 iCloud for Windows 11.5 tvOS 14.2 iTunes 12.11 for Windows. Processing maliciously crafted web content may lead to code execution.


A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1 watchOS 7.1 iOS 12.4.9 watchOS 6.2.9 Security Update 2020-006 High Sierra Security Update 2020-006 Mojave iOS 14.2 and iPadOS 14.2 watchOS 5.3.9 macOS Catalina 10.15.7 Supplemental Update macOS Catalina 10.15.7 Update. A malicious application may be able to disclose kernel memory.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in watchOS 7.2 macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave iOS 14.3 and iPadOS 14.3 tvOS 14.3. Processing a maliciously crafted audio file may lead to arbitrary code execution.


SAP BusinessObjects BI Platform (Crystal Report) versions - 4.1 4.2 4.3 does not sufficiently validate uploaded XML entities during crystal report generation due to missing XML validation An attacker with basic privileges can inject some arbitrary XML entities leading to internal file disclosure internal directories disclosure Server-Side Request Forgery (SSRF) and denial-of-service (DoS).


Highlight.js is a syntax highlighter written in JavaScript. Highlight.js versions before 9.18.2 and 10.1.2 are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting. If you allow users to insert custom HTML code blocks into your page/app via parsing Markdown code blocks (or similar) and do not filter the language names the user can provide you may be vulnerable. The pollution should just be harmless data but this can cause problems for applications not expecting these properties to exist and can result in strange behavior or application crashes i.e. a potential DOS vector. If your website or application does not render user provided data it should be unaffected. Versions 9.18.2 and 10.1.2 and newer include fixes for this vulnerability. If you are using version 7 or 8 you are encouraged to upgrade to a newer release.


A potential DOS vulnerability was discovered in all versions of Gitlab starting from 13.4.x (>=13.4 to <13.4.7 >=13.5 to <13.5.5 and >=13.6 to <13.6.2). Using a specific query name for a project search can cause statement timeouts that can lead to a potential DOS if abused.


A DOS vulnerability exists in Gitlab CE/EE >=10.3 <13.4.7 >=13.5 <13.5.5 >=13.6 <13.6.2 that allows an attacker to trigger uncontrolled resource by bypassing input validation in markdown fields.


ZTE E8820V3 router product is impacted by a permission and access control vulnerability. Attackers could use this vulnerability to tamper with DDNS parameters and send DoS attacks on the specified URL.


ZTE E8810/E8820/E8822 series routers have an MQTT DoS vulnerability which is caused by the failure of the device to verify the validity of abnormal messages. A remote attacker could connect to the MQTT server and send an MQTT exception message to the specified device which will cause the device to deny service. This affects:<ZXHN E8810 ZXHN E8820 ZXHN E8822><E8810 V1.0.26 E8810 V2.0.1 E8820 V1.1.3L E8820 V2.0.13 E8822 V2.0.13>


This

affects

the

package

codemirror

before

the

package

org.apache.marmotta.webjars:codemirror

before

The

vulnerable

regular

expression

is

located

in

The

ReDOS

vulnerability

of

the

regex

is

mainly

due

to

the

sub-pattern

(s|/*.*?*/)*


An issue was discovered in Secudos Qiata FTA 1.70.19. The comment feature allows persistent XSS that is executed when reading transfer comments or the global notice board.


When MELSOFT transmission port (UDP/IP) of Mitsubishi Electric MELSEC iQ-R series (all versions) MELSEC iQ-F series (all versions) MELSEC Q series (all versions) MELSEC L series (all versions) and MELSEC F series (all versions) receives massive amount of data via unspecified vectors resource consumption occurs and the port does not process the data properly. As a result it may fall into a denial-of-service (DoS) condition. The vendor states this vulnerability only affects Ethernet communication functions.


Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series CPU Modules (R00/01/02CPU Firmware versions from '05' to '19' and R04/08/16/32/120(EN)CPU Firmware versions from '35' to '51') allows a remote attacker to cause an error in a CPU unit via a specially crafted HTTP packet which may lead to a denial-of-service (DoS) condition in execution of the program and its communication.


MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack overflow. Review the linked GitHub Security Advisory for more information and remediation steps.


In BIG-IP Advanced WAF and FPS versions 16.0.0-16.0.0.1 15.1.0-15.1.0.5 and 14.1.0-14.1.2.7 under some circumstances certain format client-side alerts sent to the BIG-IP virtual server configured with DataSafe may cause the Traffic Management Microkernel (TMM) to restart resulting in a Denial-of-Service (DoS).


In BIG-IQ 7.1.0 accessing the DoS Summary events and DNS Overview pages in the BIG-IQ system interface returns an error message due to disabled Grafana reverse proxy in web service configuration. F5 has done further review of this vulnerability and has re-classified it as a defect. CVE-2020-5944 will continue to be referenced in F5 Security Advisory K57274211 and will not be assigned to other F5 vulnerabilities.


Improper check or handling of exceptional conditions in MELSEC iQ-F series FX5U(C) CPU unit firmware version 1.060 and earlier allows an attacker to cause a denial-of-service (DoS) condition on program execution and communication by sending a specially crafted ARP packet.


Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series modules (R00/01/02CPU firmware version '19' and earlier R04/08/16/32/120 (EN) CPU firmware version '51' and earlier R08/16/32/120SFCPU firmware version '22' and earlier R08/16/32/120PCPU firmware version '25' and earlier R08/16/32/120PSFCPU firmware version '06' and earlier RJ71EN71 firmware version '47' and earlier RJ71GF11-T2 firmware version '47' and earlier RJ72GF15-T2 firmware version '07' and earlier RJ71GP21-SX firmware version '47' and earlier RJ71GP21S-SX firmware version '47' and earlier and RJ71GN11-T2 firmware version '11' and earlier) allows a remote unauthenticated attacker to cause an error in a CPU unit and cause a denial-of-service (DoS) condition in execution of the program and its communication or to cause a denial-of-service (DoS) condition in communication via the unit by receiving a specially crafted SLMP packet


UNIVERGE SV9500 series from V1 to V7and SV8500 series from S6 to S8 allows an attacker to execute arbitrary OS commands or cause a denial-of-service (DoS) condition by sending a specially crafted request to a specific URL.


On BIG-IP AFM 15.1.0-15.1.0.5 the Traffic Management Microkernel (TMM) may produce a core file while processing layer 4 (L4) behavioral denial-of-service (DoS) traffic.


Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like \Bad-header: xxxxxxxxxxxxxxx\\x10\ is received it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and blocking any other interactions. This allows an attacker to send a single request with an invalid header and take the service offline. This issue was introduced in version 1.4.2 when the regular expression was updated to attempt to match the behaviour required by errata associated with RFC7230. The regular expression that is used to validate incoming headers has been updated in version 1.4.3 it is recommended that people upgrade to the new version of Waitress as soon as possible.


django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0 automatically generated `NumberFilter` instances whose value was later converted to an integer were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. Version 2.4.0+ applies a `MaxValueValidator` with a a default `limit_value` of 1e50 to the form field used by `NumberFilter` instances. In addition `NumberFilter` implements the new `get_max_validator()` which should return a configured validator instance to customise the limit or else `None` to disable the additional validation. Users may manually apply an equivalent validator if they are not able to upgrade.


node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect which means that when a content size was over the limit a FetchError would never get thrown and the process would end without failure. For most people this fix will have a little or no impact. However if you are relying on node-fetch to gate files above a size the impact could be significant for example: If you don't double-check the size of the data after fetch() has completed your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.


u'Lack of handling unexpected control messages while encryption was in progress can terminate the connection and thus leading to a DoS' in Snapdragon Auto Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables in APQ8053 APQ8076 MDM9640 MDM9650 MSM8905 MSM8917 MSM8937 MSM8940 MSM8953 QCA6174A QCA9886 QCM2150 QM215 SDM429 SDM439 SDM450 SDM632


Xiaomi router R3600 ROM before 1.0.50 is affected by a vulnerability when checking backup file in c_upload interface let attacker able to extract malicious file under any location in /tmp lead to possible RCE and DoS


An issue was discovered in OpenVPN Access Server before 2.7.0 and 2.8.x before 2.8.3. With the full featured RPC2 interface enabled it is possible to achieve a temporary DoS state of the management interface when sending an XML Entity Expansion (XEE) payload to the XMLRPC based RPC2 interface. The duration of the DoS state depends on available memory and CPU speed. The default restricted mode of the RPC2 interface is NOT vulnerable.


JetBrains YouTrack before 2020.1.659 was vulnerable to DoS that could be caused by attaching a malformed TIFF file to an issue.


This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave iOS 14.3 and iPadOS 14.3 tvOS 14.3. Processing a maliciously crafted file may lead to heap corruption.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 14.3 macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave iOS 14.3 and iPadOS 14.3 iCloud for Windows 12.0 watchOS 7.2. Processing a maliciously crafted image may lead to arbitrary code execution.


An issue was discovered in Xen 4.6 through 4.14.x. When acting upon a guest XS_RESET_WATCHES request not all tracking information is freed. A guest can cause unbounded memory usage in oxenstored. This can lead to a system-wide DoS. Only systems using the Ocaml Xenstored implementation are vulnerable. Systems using the C Xenstored implementation are not vulnerable.


\Clear History and Website Data\ did not clear the history. The issue was addressed with improved data deletion. This issue is fixed in macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave iOS 14.3 and iPadOS 14.3 tvOS 14.3. A user may be unable to fully delete browsing history.


This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter or by implementing request timeouts and limiting process memory.


Some Huawei products have a security vulnerability due to improper authentication. A remote attacker needs to obtain some information and forge the peer device to send specific packets to the affected device. Due to the improper implementation of the authentication function attackers can exploit the vulnerability to connect to affected devices and execute a series of commands.Affected product versions include:Secospace AntiDDoS8000 versions V500R001C00 V500R001C20 V500R001C60 V500R005C00.


A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect software running on Mac OS allows authenticated local users to cause the Mac OS kernel to hang or crash. This issue affects GlobalProtect 5.0.5 and earlier versions of GlobalProtect 5.0 on Mac OS.


Insufficient boundary checks when decoding JSON in handleBackslash reads out of bounds memory potentially leading to DOS. This issue affects HHVM 4.45.0 4.44.0 4.43.0 4.42.0 4.41.0 4.40.0 4.39.0 versions between 4.33.0 and 4.38.0 (inclusive) versions between 4.9.0 and 4.32.0 (inclusive) and versions prior to 4.8.7.


Insufficient boundary checks when decoding JSON in JSON_parser allows read access to out of bounds memory potentially leading to information leak and DOS. This issue affects HHVM 4.45.0 4.44.0 4.43.0 4.42.0 4.41.0 4.40.0 4.39.0 versions between 4.33.0 and 4.38.0 (inclusive) versions between 4.9.0 and 4.32.0 (inclusive) and versions prior to 4.8.7.


Insufficient boundary checks when decoding JSON in TryParse reads out of bounds memory potentially leading to DOS. This issue affects HHVM 4.45.0 4.44.0 4.43.0 4.42.0 4.41.0 4.40.0 4.39.0 versions between 4.33.0 and 4.38.0 (inclusive) versions between 4.9.0 and 4.32.0 (inclusive) and versions prior to 4.8.7.