Victor Pereira

A security issue exists where a user with permissions to create an Ingress can cause a denial of service of the data plane or potentially redirect traffic from other Ingresses. This occurs because a missing check allows the `mirror-target` Ingress annotation to target an unauthenticated configuration API within the controller, enabling the submission of write commands. Corrupting the data in this API causes all traffic through the controller to be dropped until a configuration change or a restart occurs. While traffic redirection is theoretically possible, it requires privileged information about the internal state of the controller.

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') issue allows remote attackers to place Javascript into SVG files.

A vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations, potentially gaining information from the server that can be abused to escalate to Admin privileges on OBS.

A Improper Neutralization of Input During Web Page Generation issue allows remote attackers to store arbitrary JS code, causing XSS.

The issue allows remote users to decrypt communications due to a problem with SaltStack RSA Key Generation.

The issue concerns a CSRF problem that affects requests to change permissions.

The issue concerns Horde Groupware Webmail Edition, which has problems with CSRF and XSS when saving a search as a virtual address book.

The issue is related to a missing check on the number of pages, which can lead to a segmentation fault.

The issue allows remote attackers to execute arbitrary code or cause a denial of service via a large XML document. This can lead to a stack-based buffer overflow and application crash.

An off-by-one error was found in openldap when processing DNS SRV messages, potentially leading to a crash. This issue affects configurations using the dnssrv backend, where an attacker could exploit the service with crafted DNS responses, causing it to crash.

The issue concerns the mirroring support in Python Pip, which uses insecure DNS querying and authenticity checks. This allows attackers to perform man-in-the-middle attacks.

The issue is related to a buffer overrun that could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.