Moritz Muehlenhoff

The issue allows remote attackers to cause a considerable CPU load, also known as the "Hash DoS attack", by exploiting a hash collision attack vulnerability. This could lead to a denial-of-service condition.

The issue is related to the improper authorization of CA certificates for signing other certificates.

The issue arises from a server certificate that is not properly authorized for server authentication.

The issue concerns the lack of filtering for specific directories in path names.

The issue is related to the mad decoder run() function in decoder.c, which allows remote attackers to cause a denial of service or possibly have other unspecified impacts via a crafted file. This could result in a SIGABRT due to double free or corruption.

The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in unspecified vectors. This is related to the lib/graph export.php file.

A cross-site request forgery issue allows remote attackers to hijack user authentication for unspecified commands. This can be demonstrated by requests that modify binary files, modify configurations, or add arbitrary users.

A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML.

The issue allows remote attackers to obtain sensitive information via specific attributes in various tags when a container supports Expression Language (EL). This is due to the evaluation of EL expressions in tags twice. The affected attributes include `name` in `spring:hasBindErrors` tags, `path` in `spring:bind` or `spring:nestedpath` tags, and several attributes in `spring:message`, `spring:theme`, and `spring:transform` tags, such as `arguments`, `code`, `text`, `var`, `scope`, `message`, and `value`.

The issue allows remote attackers to obtain sensitive information and possibly re-install Drupal and execute arbitrary PHP code via an external database server, related to transient conditions.

The issue allows remote OpenID servers to read arbitrary files via a crafted DOCTYPE declaration in an XRDS file.

The issue allows local users to overwrite arbitrary files via a symlink attack on a PID file. This can be achieved by using a pathname different from the default /var/run/monkey.pid pathname.

A directory traversal issue exists, allowing local users to read arbitrary files.

The issue is related to a heap-based buffer overflow in the OGG demuxer, specifically in the Ogg DecodePacket function. This can be triggered by a crafted OGG file, potentially allowing remote attackers to cause the application to crash or possibly execute arbitrary code.

The issue makes it easier for local users to create or truncate files via a symlink attack because the random number generator is not seeded and generates predictable temporary file names.

The issue affects confidentiality and availability. It can be exploited by remote authenticated users via unknown vectors.

General information about the issue is not provided.

The issue affects confidentiality and integrity, allowing remote authenticated users to exploit it via unknown vectors.

General information about the issue is not available.

The issue is related to a security problem, but specific details are not provided.