Netlogon Elevation of Privilege Vulnerability

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core)

In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element

A flaw was found in libxml2

Excessive memory consumption in MS-WSP dissector in Wireshark 3.4.0 to 3.4.4 and 3.2.0 to 3.2.12 allows denial of service via packet injection or crafted capture file

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of…

In Wireshark 3.2.0 to 3.2.5, the Kafka protocol dissector could crash

net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3

A XSS vulnerability was discovered in python-lxml's clean module

An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7

In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to…

mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // after http: in the target URL

In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF

NULL pointer deref in signature_algorithms processing

The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509…

An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7

There's a flaw in Python 3's pydoc

There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel)

Crash in the pcapng file parser in Wireshark 3.6.0 allows denial of service via crafted capture file

A flaw was found in SQLite's SELECT query functionality (src/select.c)

SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c

ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)

In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0…

Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'

Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection…

Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file

Crash in USB HID protocol dissector and possibly other dissectors in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted capture file

Memory leak in RTPS protocol dissector in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted capture file

Memory leak in the dissection engine in Wireshark 3.4.0 allows denial of service via packet injection or crafted capture file

Memory leak in Kafka protocol dissector in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted capture file

In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Object Store)

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Remote Replication)

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Remote Replication)

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core)

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Filesystems)

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Analytics)

ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not…

An issue was discovered in the server in OpenLDAP before 2.4.48

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: User Interface)

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core)

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Object Store)