11633 matches found
Security Bulletin: Apache CXF (Publicly disclosed vulnerability)
Summary CXF supports via JwtRequestCodeFilter passing OAuth 2 parameters via a JWT token as opposed to query parameters see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request JAR. Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a U...
Fedora: Security Advisory for libtpms (FEDORA-2021-8d699b5267)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
webTareas path traversal vulnerability
webTareas is a Web-based open source collaboration tool. The product supports project management, bug tracking, content management and meeting management. webTareas version 2.0 has a path traversal vulnerability, which stems from the fact that the extpath parameter in generalserv .php is not...
Fedora: Security Advisory for xscreensaver (FEDORA-2021-5af4452ffd)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
CVE-2020-23069
Path Traversal vulneraility exists in webTareas 2.0 via the extpath parameter in generalserv.php, which could let a malicious user read arbitrary files...
Path traversal
Path Traversal vulneraility exists in webTareas 2.0 via the extpath parameter in generalserv.php, which could let a malicious user read arbitrary files...
pdfbox: infinite loop while loading a crafted PDF file
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions...
Code injection
ThroughTek's Kalay Platform 2.0 network allows an attacker to impersonate an arbitrary ThroughTek TUTK device given a valid 20-byte uniquely assigned identifier UID. This could result in an attacker hijacking a victim's connection and forcing them into supplying credentials needed to access the...
CVE-2021-28372
CVE-2021-28372 affects ThroughTek’s Kalay Platform (Kalay Platform 2.0) and Kalay P2P SDK. The root cause is a device impersonation flaw: an attacker who obtains a valid 20-byte Kalay UID can register or hijack a device on the Kalay network, causing client connections to be redirected and enablin...
LockBit 2.0 Ransomware Proliferates Globally
The LockBit ransomware-as-a-service RaaS gang has ramped up its targeted attacks, researchers said, with attempts against organizations in Chile, Italy, Taiwan and the U.K. using version 2.0 of its malware. Attacks in July and August have employed LockBit 2.0, according to a Trend Micro analysis...
OPENSUSE-SU-2021:1162-1 Security update for SUSE Manager Client Tools
This update fixes the following issues: ansible: - The support level for ansible is l2, not l3 dracut-saltboot: - Force installation of libexpat.so.1 bsc1188846 - Use kernel parameters from PXE formula also for local boot golang-github-prometheus-prometheus: - Provide and reload firewalld...
Fedora: Security Advisory for rust-argh_shared (FEDORA-2021-3cf88e44b4)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Photon OS 2.0: C PHSA-2021-2.0-0378
An update of the c package has been released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-2.0-0378. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc';...
Padding oracle attacks
It was found that all OWASP ESAPI for Java up to version 2.0 RC2 are vulnerable to padding oracle attacks...
Code injection
On 2N Access Unit 2.0 2.31.0.40.5 devices, an attacker can pose as the web relay for a man-in-the-middle attack...
openSUSE: Security Advisory for golang-github-prometheus-prometheus (openSUSE-SU-2021:2664-1)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Fedora: Security Advisory for mod_auth_openidc (FEDORA-2021-e3017c538a)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
SUSE-SU-2021:2664-1 Security update for golang-github-prometheus-prometheus
This update for golang-github-prometheus-prometheus fixes the following issues: - Provide and reload firewalld configuration only for: + openSUSE Leap 15.0, 15.1, 15.2 + SUSE SLE15, SLE15 SP1, SLE15 SP2 - Upgrade to upstream version 2.27.1 jscSLE-18254 + Bugfix: SECURITY: Fix arbitrary redirects...
Security update for golang-github-prometheus-prometheus (moderate)
openSUSE Security Update: Security update for golang-github-prometheus-prometheus Announcement ID: openSUSE-SU-2021:2664-1 Rating: moderate References: 1186242 SLE-18254 Cross-References: CVE-2021-29622 CVSS scores: CVE-2021-29622 NVD : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected...
