OPENSUSE-SU-2021:1595-1 Security update for barrier

This update for barrier fixes the following issues: Updated to version 2.4.0: Barrier now supports client identity verification fixes CVE-2021-42072, CVE-2021-42073. Previously a malicious client could connect to Barrier server without any authentication and send application-level messages. This...

CVE-2021-43836 PHP file inclusion in the Sulu admin panel

Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions an attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution. The problem is patched with the Versions 1.6.44, 2.2.18...

openSUSE: Security Advisory for barrier (openSUSE-SU-2021:1498-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

MGASA-2021-0511 Updated python-django-filter packages fix security vulnerability

In django-filter before version 2.4.0, automatically generated 'NumberFilter' instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents...

openjpeg2 security update

2.4.0-4 - Fix Covscan defect 2.4.0-3 - Fix CVE-2021-3575 1969279 - Fix resource leak identified by Covscan 2.4.0-2 - Fix CVE-2021-29338 1951332 2.4.0-1 - Rebase to 2.4.0 - Resolves: CVE-2018-5727 1538467 - Resolves: CVE-2018-5785 1538556 - Resolves: CVE-2018-20845 1730679 - Resolves: CVE-2018-208...

eProsima Fast RTPS 安全漏洞

eProsima Fast RTPS is a C++ implementation of the RTPS Real Time Publish Subscribe protocol. A security vulnerability exists in eProsima Fast RTPS, which is caused by the product's failure to effectively handle incoming special data. The vulnerability can be exploited to cause a denial of service...

Design/Logic Flaw

An issue was discovered in Barrier before 2.4.0. An attacker can enter an active session state with the barriers component aka the server-side implementation of Barrier simply by supplying a client label that identifies a valid client configuration. This label is "Unnamed" by default but could...

CVE-2021-42072

An issue was discovered in Barrier before 2.4.0. The barriers component aka the server-side implementation of Barrier does not sufficiently verify the identify of connecting clients. Clients can thus exploit weaknesses in the provided protocol to cause denial-of-service or stage further attacks...

WordPress Restaurant Menu by MotoPress Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. WordPress Restaurant Menu by MotoPress Plugin in version 2.4.0 and earlier has a cross-site scripting...

WordPress 插件跨站脚本漏洞

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. WordPress Restaurant Menu by MotoPress Plugin in version 2.4.0 and earlier has a cross-site scripting...

PYSEC-2021-382

qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, the Windows installer for qutebrowser registers a qutebrowserurl: URL handler. With certain applications, opening a specially crafted qutebrowserurl:... URL can lead to execution of...

CVE-2021-3455

Disconnecting L2CAP channel right after invalid ATT request leads freeze. Zephyr versions = 2.4.0, = 2.5.0 contain Use After Free CWE-416. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7g38-3x9v-v7vp...

WordPress 插件信息泄露漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on servers running PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. An information disclosure vulnerability exists in the...

CVE-2021-37595

In FreeRDP before 2.4.0 on Windows, wfcliprdrserverfilecontentsrequest in client/Windows/wfcliprdr.c has missing input checks for a FILECONTENTSRANGE File Contents Request PDU...

FreeRDP 输入验证错误漏洞

FreeRDP is an open source implementation of the Remote Desktop Protocol RDP from the FreeRDP Freerdp team. An input validation error vulnerability exists in versions prior to FreeRDP 2.4.0, which stems from clipboard redirection being enabled by default. An attacker could read arbitrary files fro...

Security Bulletin: IBM i2 Analyze missing security header (CVE-2021-29769)

Summary Some secure header options were missing in communication with the i2 Analyze server. Vulnerability Details CVEID: CVE-2021-29769 DESCRIPTION: IBM i2 Analyst's Notebook Premium does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the...

CVE-2021-32739

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From version 2.4.0 through version 2.12.4, a vulnerability exists that may allow privilege escalation for authenticated API users. With a...

CVE-2021-32739

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From version 2.4.0 through version 2.12.4, a vulnerability exists that may allow privilege escalation for authenticated API users. With a...

CVE-2021-32739 Results of queries for ApiListener objects include the ticket salt which allows in turn to steal (more privileged) identities

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From version 2.4.0 through version 2.12.4, a vulnerability exists that may allow privilege escalation for authenticated API users. With a...

Icinga 安全漏洞

Icinga is a scalable server and network resource monitoring system from the German company Icinga. A security vulnerability exists in Icinga that stems from a privilege escalation issue in Icinga from versions 2.4.0 to 2.12.4 that allows authenticated API users. The vulnerability can be exploited...