Netapp H700s Firmware vulnerabilities

CVE-2021-22922 Medium · 6.5 CWE-755 Aug 5, 2021

When curl is instructed to download content using the metalink feature, thecontents is verified...

When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.

CVE-2021-3541 Medium · 6.5 CWE-776 Jul 9, 2021

A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all...

A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.

CVE-2021-22555 High · 7.8 KEV Urgent · 76 Public exploit CWE-787 Jul 7, 2021

Linux Kernel Heap Out-of-Bounds Write Vulnerability

A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space

CVE-2020-28097 Medium · 5.9 CWE-125 Jun 24, 2021

The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a...

The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a vgacon_scrolldelta out-of-bounds read, aka CID-973c096f6a85.

CVE-2021-22901 High · 8.1 CWE-416 Jun 11, 2021

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed...

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When using that memory, libcurl might even call a function pointer in the object, making it possible for a remote code execution if the server could somehow manage to get crafted memory content into the correct place in memory.

CVE-2021-22897 Medium · 5.3 CWE-668 Jun 11, 2021

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a...

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.

CVE-2021-33574 Critical · 9.8 CWE-416 May 25, 2021

The mq_notify function in the GNU C Library (aka glibc) through 2.33 has a use-after-free. It may...

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

CVE-2020-27618 Medium · 5.5 CWE-835 Feb 26, 2021

Infinite Loop in Gnu Glibc

The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228.

CVE-2020-14155 Medium · 5.3 CWE-190 Jun 15, 2020

Integer Overflow or Wraparound in Pcre

libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.

CVE-2020-12769 Medium · 5.5 CWE-662 May 9, 2020

Improper Synchronization in Linux Linux Kernel

An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one, aka CID-19b61392c5a8.

CVE-2020-11023 Medium · 6.1 KEV High · 67 Public exploit CWE-79 Apr 29, 2020

JQuery Cross-Site Scripting (XSS) Vulnerability

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVE-2020-12243 High · 7.5 CWE-674 Apr 28, 2020

In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean...

In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).

CVE-2020-7595 High · 7.5 CWE-835 Jan 21, 2020

libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

CVE-2019-20388 High · 7.5 CWE-401 Jan 21, 2020

xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.

CVE-2019-2215 High · 7.8 KEV Urgent · 76 Public exploit CWE-416 Oct 11, 2019

Android Kernel Use-After-Free Vulnerability

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095