CVE-2019-10200

A flaw was discovered in OpenShift Container Platform 4 where, by default, users with access to create pods also have the ability to schedule workloads on master nodes. Pods with permission to access the host network, running on master nodes, can retrieve security credentials for the master AWS I...

PT-2021-8867

Name of the Vulnerable Software and Affected Versions OpenShift Container Platform 4 affected versions not specified Description A flaw was discovered where users with access to create pods also have the ability to schedule workloads on master nodes. Pods with permission to access the host networ...

CVE-2019-10200: Improper Access Control

A flaw was discovered in OpenShift Container Platform 4 where, by default, users with access to create pods also have the ability to schedule workloads on master nodes. Pods with permission to access the host network, running on master nodes, can retrieve security credentials for the master AWS I...

UBUNTU-CVE-2020-35492

A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo's image-compositor for example, by convincing a user to open a file in an application using cairo, or if an application uses cairo on untruste...

Important: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Rails Sprockets 2.x < 2.12.5 / 3.x < 3.7.2 / 4.x < 4.0.0.beta8 Path Traversal

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is...

Imperva recognized as a ‘Leader’ in The Forrester Wave™: DDoS Mitigation Solutions, Q1 2021 Report

We are delighted to share that Imperva has been named a leader in The Forrester Wave: DDoS Mitigation Solutions, Q1 2021 report, a trusted source for technology buyers which helps security and risk professionals select the right vendor for their needs. You can download a copy of the report here...

Sony Playstation 4 Use-After-Free

A use-after-free vulnerability exists in Sony Playstation 4. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

OSV-2021-496 Heap-buffer-overflow in blosc_d

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31710 Crash type: Heap-buffer-overflow READ 4 Crash state: bloscd dojob bloscrundecompressionwithcontext...

Exploit for Improper Input Validation in Vmware View_Planner

CVE-2021-21978 CVE-2021-21978: Remote Code Execution vulnera...

OSV-2021-485 Heap-buffer-overflow in blosc_run_decompression_with_context

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31585 Crash type: Heap-buffer-overflow READ 4 Crash state: bloscrundecompressionwithcontext blosc2decompressctx framedecompresschunk...

OSV-2021-482 Heap-buffer-overflow in draco::MeshPredictionSchemeTexCoordsDecoder<int, draco::PredictionSchemeWrapDeco

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31587 Crash type: Heap-buffer-overflow WRITE 4 Crash state: draco::MeshPredictionSchemeTexCoordsDecoderint, draco::PredictionSchemeWrapDeco draco::MeshPredictionSchemeTexCoordsDecoderint, draco::PredictionSchemeWrapDeco...

CVE-2021-27888

ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters...

Server side request forgery (ssrf)

The vSphere Client HTML5 contains an SSRF Server Side Request Forgery vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information...

CVE-2021-20198: Missing Authentication for Critical Function

A flaw was found in the OpenShift Installer before version v0.9.0-master.0.20210125200451-95101da940b0. During installation of OpenShift Container Platform 4 clusters, bootstrap nodes are provisioned with anonymous authentication enabled on kubelet port 10250. A remote attacker able to reach this...

Siemens DIGSI 4 Elevation of Privilege Vulnerability

DIGSI 4 is the operating and configuration software for the SIPROTEC 4 and SIPROTEC Compact Protection Unit. An elevation of privilege vulnerability exists in Siemens DIGSI 4. An attacker could exploit the vulnerability by placing a DLL with system-executed code...

AZL-44085 CVE-2020-28500 affecting package js-jquery 3.5.0-4

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service ReDoS via the toNumber, trim and trimEnd functions...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : JUnit 4 vulnerability (USN-4731-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4731-1 advisory. It was discovered that JUnit 4 contains a local information disclosure vulnerability. An attacker could possibly use this issue to obtain...

USN-4731-1: JUnit 4 vulnerability

It was discovered that JUnit 4 contains a local information disclosure vulnerability. An attacker could possibly use this issue to obtain sensitive information...

CVE-2020-25245

A vulnerability has been identified in DIGSI 4 All versions V4.94 SP1 HF 1. Several folders in the %PATH% are writeable by normal users. As these folders are included in the search for dlls, an attacker could place dlls there with code executed by SYSTEM...