漏洞公告

Authelia vulnerable to an authentication bypassed with malformed request URI on nginx

Excessive Platform Resource Consumption within a Loop in Kubernetes

Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion

Incorrect Comparison in NumPy

Pyo Buffer Overflow Vulnerability

bounter Null pointer reference

Using JMSAppender in log4j configuration may lead to deserialization of untrusted data

Malicious Atomix node queries expose sensitive information

An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to join a target cluster via providing configuration information.

An issue in Atomix v3.1.5 allows a malicious Atomix node to remove states of ONOS storage via abuse of primitive operations.

A vulnerability in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via a Raft session flooding attack using Raft OpenSessionRequest messages.

An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false member down event messages.

An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false link event messages sent to a master ONOS node.

An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to become the lead node.

Deserialization of Untrusted Data in logback

livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)

yetiforcecrm is vulnerable to Cross-site Scripting

Path traversal when MessageBus::Diagnostics is enabled

Regular Expression Denial of Service (ReDoS) in jsx-slack

ThinkPHP5 SQL Injection vulnerability

vault-cli contains possible RCE when reading user-defined data

Critical vulnerability in log4j may affect generated PEAR projects

YetiForceCRM is vulnerable to Business Logic Errors because product amount can be a negative number