SUSE: Security Advisory (SUSE-SU-2021:3123-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-38153

Some components in Apache Kafka use Arrays.equals to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been...

Fedora: Security Advisory for libtpms (FEDORA-2021-db6fb33b05)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Photon OS 2.0: Curl PHSA-2021-2.0-0392

An update of the curl package has been released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-2.0-0392. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc...

CVE-2021-33693

SAP Cloud Connector, version - 2.0, allows an authenticated administrator to modify a configuration file to inject malicious codes that could potentially lead to OS command execution...

CVE-2021-33695

Potentially, SAP Cloud Connector, version - 2.0 communication with the backend is accepted without sufficient validation of the certificate...

CVE-2021-33694

SAP Cloud Connector, version - 2.0, does not sufficiently encode user-controlled inputs, allowing an attacker with Administrator rights, to include malicious codes that get stored in the database, and when accessed, could be executed in the application, resulting in Stored Cross-Site Scripting...

Cross site scripting

SAP Cloud Connector, version - 2.0, does not sufficiently encode user-controlled inputs, allowing an attacker with Administrator rights, to include malicious codes that get stored in the database, and when accessed, could be executed in the application, resulting in Stored Cross-Site Scripting...

CVE-2021-33693

SAP Cloud Connector, version - 2.0, allows an authenticated administrator to modify a configuration file to inject malicious codes that could potentially lead to OS command execution...

CVE-2021-33695

Potentially, SAP Cloud Connector, version - 2.0 communication with the backend is accepted without sufficient validation of the certificate...

CVE-2021-33692

SAP Cloud Connector (v2.0) contains a path traversal vulnerability exploited via uploaded backup ZIPs. The issue allows crafting backups containing sequences like .. and / to escape the restricted directory and access files or directories outside the intended location. Multiple connected sources ...

EulerOS 2.0 SP2 : libmspack (EulerOS-SA-2021-2398)

According to the version of the libmspack package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathname...

EulerOS 2.0 SP2 : screen (EulerOS-SA-2021-2447)

According to the version of the screen package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service invalid write access and application crash or possibly...

EulerOS 2.0 SP2 : evince (EulerOS-SA-2021-2366)

According to the version of the evince packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/tiff/tiff-document.c. The...

EulerOS 2.0 SP2 : cpio (EulerOS-SA-2021-2362)

According to the version of the cpio package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The cpiosafernamesuffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service out-of-bounds write via a crafted cpio...

EulerOS 2.0 SP2 : fence-agents (EulerOS-SA-2021-2368)

According to the version of the fence-agents packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields would...

EulerOS 2.0 SP2 : gstreamer1-plugins-good (EulerOS-SA-2021-2377)

According to the version of the gstreamer1-plugins-good package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska...

EulerOS 2.0 SP2 : java-1.8.0-openjdk (EulerOS-SA-2021-2389)

According to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries. Supported versions that are affected...

EulerOS 2.0 SP2 : python-pillow (EulerOS-SA-2021-2432)

According to the versions of the python-pillow package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative t...

EulerOS 2.0 SP2 : lz4 (EulerOS-SA-2021-2407)

According to the version of the lz4 package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to...