532 matches found
babel security and bug fix update
2.5.1-7 - Include the /usr/bin/pybabel binary that runs on Python 3.6 in the python3-babel package Resolves: rhbz1967173 2.5.1-6 - Fix CVE-2021-20095 Resolves: rhbz1955615...
PT-2021-21091
Name of the Vulnerable Software and Affected Versions: NETGEAR WAC104 versions prior to 1.0.4.15 Description: The issue allows an unauthenticated attacker to bypass authentication by invoking any action through the /usr/sbin/mini httpd service. This is achieved by adding the ¤tsetting.htm...
PT-2021-27342
Name of the Vulnerable Software and Affected Versions: libdwarf affected versions not specified Description: The issue with libdwarf involves a hardening update to link /usr/bin/dwarfdump as PIE. Recommendations: At the moment, there is no information about a newer version that contains a fix for...
CVE-2021-30462: Missing Authentication for Critical Function
VestaCP through 0.9.8-24 allows the admin user to escalate privileges to root because the Sudo configuration does not require a password to run /usr/local/vesta/bin scripts...
PT-2021-18738
Name of the Vulnerable Software and Affected Versions VestaCP versions prior to 0.9.8-25 Description The issue allows the admin user to escalate privileges to root due to the Sudo configuration not requiring a password to run /usr/local/vesta/bin scripts. Recommendations For versions prior to...
Command Execution Vulnerability in USR-G781 with Character Networking
Ltd. is an industrial IoT hardware and software solution provider. There is a command execution vulnerability in USR-G781, which can be exploited by attackers to execute malicious code...
PT-2021-7249
Name of the Vulnerable Software and Affected Versions Infiray IRAY-A8Z3 version 1.0.957 Description An issue was discovered in the binary file /usr/local/sbin/webproject/set param.cgi, which contains hardcoded credentials to the web application. These accounts are considered backdoor accounts...
RLSA-2020:5503 Moderate: mariadb-connector-c security, bug fix, and enhancement update
The MariaDB Native Client library C driver is used to connect applications developed in C/C++ to MariaDB and MySQL databases. The following packages have been upgraded to a later upstream version: mariadb-connector-c 3.1.11. BZ1898993 Security Fixes: mysql: C API unspecified vulnerability CPU Apr...
PT-2020-15632
Name of the Vulnerable Software and Affected Versions Verint 5620PTZ version Verint FW 0 42 Verint 4320 versions V4320 FW 0 23 through V4320 FW 0 31 Description The issue concerns an autodiscovery service in the /usr/sbin/DM binary executable, which listens on port TCP 6666 and is vulnerable to a...
CVE-2019-7305
Information Exposure vulnerability in eXtplorer makes the /usr/ and /etc/extplorer/ system directories world-accessible over HTTP. Introduced in the Makefile patch file debian/patches/debian-changes-2.1.0b6+dfsg-1 or debian/patches/adds-a-makefile.patch, this can lead to data leakage, information...
PT-2020-11242
Name of the Vulnerable Software and Affected Versions eXtplorer affected versions not specified Description The issue allows the /usr/ and /etc/extplorer/ system directories to be world-accessible over HTTP, potentially leading to data leakage, information disclosure, and remote code execution on...
CVE-2019-7656: Incorrect Permission Assignment for Critical Resource
A privilege escalation vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any unprivileged Linux user to escalate privileges to root. The installer sets too relaxed permissions on /usr/local/WowzaStreamingEngine/bin/ core program files. By injecting a payload into one of those files...
PT-2020-1808
Name of the Vulnerable Software and Affected Versions Wowza Streaming Engine versions 4.8.0 and earlier Wowza Streaming Engine versions 4.7.7 and 4.7.8 Description A privilege escalation issue allows any unprivileged Linux user to escalate privileges to root. The installer sets too relaxed...
CVE-2019-20384
Gentoo Portage through 2.3.84 allows local users to place a Trojan horse plugin in the /usr/lib64/nagios/plugins directory by leveraging access to the nagios user account, because this directory is writable in between a call to emake and a call to fowners...
CVE-2019-20384
Gentoo Portage through 2.3.84 allows local users to place a Trojan horse plugin in the /usr/lib64/nagios/plugins directory by leveraging access to the nagios user account, because this directory is writable in between a call to emake and a call to fowners...
CVE-2019-20384: Concurrent Execution using Shared Resource with Improper Synchronization
Gentoo Portage through 2.3.84 allows local users to place a Trojan horse plugin in the /usr/lib64/nagios/plugins directory by leveraging access to the nagios user account, because this directory is writable in between a call to emake and a call to fowners...
PT-2020-10411
Name of the Vulnerable Software and Affected Versions Gentoo Portage versions 2.3.84 and earlier Description The issue allows local users to place a Trojan horse plugin in the /usr/lib64/nagios/plugins directory by leveraging access to the nagios user account. This is possible because the directo...
CVE-2019-18842
A cross-site scripting XSS vulnerability in the configuration web interface of the Jinan USR IOT USR-WIFI232-S/T/G2/H Low Power WiFi Module with web version 1.2.2 allows attackers to leak credentials of the Wi-Fi access point the module is logged into, and the web interface login credentials, by...
CVE-2019-18842
A cross-site scripting XSS vulnerability in the configuration web interface of the Jinan USR IOT USR-WIFI232-S/T/G2/H Low Power WiFi Module with web version 1.2.2 allows attackers to leak credentials of the Wi-Fi access point the module is logged into, and the web interface login credentials, by...
Cross site scripting
A cross-site scripting XSS vulnerability in the configuration web interface of the Jinan USR IOT USR-WIFI232-S/T/G2/H Low Power WiFi Module with web version 1.2.2 allows attackers to leak credentials of the Wi-Fi access point the module is logged into, and the web interface login credentials, by...