NetApp Ontap Tools - for Vmware Vsphere

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character.

MongoDB Server may allow successful untrusted connection

Apache CXF SSRF Vulnerability using the Aegis databinding

Stack overflow in Protocol Buffers Java Lite

Apache Tomcat: Denial of Service

Openssh: regresshion - race condition in ssh allows rce/dos

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction

Possible denial of service in X.509 name checks

Apache Tomcat: HTTP/2 excess header handling DoS

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.

REXML ReDoS vulnerability

Certifi removes GLOBALTRUST root certificate

Apache HttpComponents: PSL (Public Suffix List) validation bypass

ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.

Kernel: cifs filesystem decryption improper input validation remote code execution vulnerability in function receive_encrypted_standard of client

Apache HTTP Server: HTTP response splitting

Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()

lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.

OCSP stapling bypass with GnuTLS

Apache HTTP Server: HTTP Response Splitting in multiple modules

Apache HTTP Server: source code disclosure with handlers configured via AddType

ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()

An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This could lead to the GDBus-based client behaving incorrectly, with an application-dependent impact.

Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

netrc and default credential leak