GSD-2021-1001764 mcb: fix error handling in mcb_alloc_bus()

mcb: fix error handling in mcballocbus This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.14.9 by commit 9fc198f415dee070a1de957bb5bf5921d8df349...

GSD-2021-1001723 mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap

mac80211: limit injected vht mcs/nss in ieee80211parsetxradiotap This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.14.10 by commit...

CVE-2021-3546[78]: Akkadian Console Server Vulnerabilities (FIXED)

!CVE-2021-3546\78: Akkadian Console Server Vulnerabilities \FIXED\https://blog.rapid7.com/content/images/2021/09/akkadian-vuln.jpg Over the course of routine security research, Rapid7 researchers Jonathan Peterson, Cale Black, William Vu, and Adam Cammack discovered that the Akkadian Console ofte...

WordPress Plugin ProfilePress 3.1.3 - Privilege Escalation (Unauthenticated)

Exploit Title: WordPress Plugin ProfilePress 3.1.3 - Privilege Escalation Unauthenticated Date: 23-08-2021 Exploit Author: Numan Rajkotiya Vendor Homepage: https://profilepress.net/ Software Link: https://downloads.wordpress.org/plugin/wp-user-avatar.3.0.zip Version: 1 ProfilePress Formerly WP Us...

Cross site scripting via HTML attributes in the back end

Date : 2021-08-11 CVE ID : CVE-2021-35955 Description It is possible for untrusted users to inject malicious code into HTML attributes in the back end, which will be executed both in the element preview back end and on the website front end. Installations are only affected if there are untrusted...

CVE-2021-37155

wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request differs from the serial number in the OCSP response...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request differs from the serial number in the OCSP response. Remediation Upgrade wolfssl to version 4.8....

UBUNTU-CVE-2021-37155

wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request differs from the serial number in the OCSP response...

GSD-2021-1000628 net: dsa: fix a crash if ->get_sset_count() fails

net: dsa: fix a crash if -getssetcount fails This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.124 by commit...

Security and Quality Rollup for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 (KB5003780)

Security and Quality Rollup for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 KB5003780 Applies to: Microsoft .NET Framework 3.5 Microsoft .NET Framework 4.5.2 Microsoft .NET Framework 4.6 Microsoft .NET Framework 4.6.1 Microsoft .NET Framework 4.6.2...

CVE-2021-28399

OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email address via the forgot password function...

Default credentials

OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email address via the forgot password function...

CVE-2021-28399

Summary: CVE-2021-28399 affects OrangeHRM 4.7. An unauthenticated attacker can use the Forgot Password function to enumerate valid usernames and associated email addresses. The vulnerability is classified as an information disclosure issue with network access and low attack complexity, as describ...

CVE-2021-28399

OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email address via the forgot password function...

WordPress 4.7-5.7 - Authenticated Password Protected Pages Exposure

Description The Latest Posts block in the WordPress editor can be exploited in a way that exposes password-protected posts and pages via the posts REST API when the "edit" context was used. This requires at least contributor privileges. PoC 1. As one user, create a new password protected post...

WordPress core 4.7-5.7 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Mikael Korpela in WordPress core versions 4.7-5.7. Solution Update the WordPress core to the latest available version at least 5.7.1...

LUCY Security Awareness Software 操作系统命令注入漏洞

LUCY Security Awareness Software is an application from LUCY Switzerland. the industry-leading real-time operating system for building embedded devices and systems. A security vulnerability exists in LUCY Security Awareness Software through 4.7.x that allows unauthenticated remote code execution...

2020-10 Security and Quality Rollup for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2008 R2 for x64 (KB4579977)

A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.7 low-latency extras security and bug fix update

An update for cnf-tests-container, dpdk-base-container, performance-addon-operator-bundle-registry-container, performance-addon-operator-container, and performance-addon-operator-must-gather-rhel8-container is now available for Red Hat OpenShift Container Platform 4.7. Red Hat Product Security ha...

CVE-2020-27816

The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original openshift-logging console link kibana console to different one, created based on the new CR for the new kibana resource. This could lead to an...