Oracle Communications Session Border Controller 8.3

fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05.

Published: 2021-07-20T18:01:34.000Z
Updated: 2024-08-04T00:05:52.143Z

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

Published: 2019-09-16T18:06:35.000Z
Updated: 2026-04-15T20:55:58.217Z

Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.

Published: 2019-09-16T18:05:38.000Z
Updated: 2026-04-16T14:08:12.584Z

If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).

Published: 2019-02-27T23:00:00.000Z
Updated: 2024-09-17T04:20:35.057Z

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

Published: 2019-11-08T14:46:03.000Z
Updated: 2025-07-07T13:55:51.360Z