Updated krb5-appl packages fix security vulnerabilities

An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned only directory traversa...

PT-2021-4232 · Linux +9 · Linux Kernel +9

Name of the Vulnerable Software and Affected Versions: Linux kernel versions through 5.12.2 Description: The issue is caused by a race condition in the net/bluetooth/hci request.c component of the Linux operating system, resulting from concurrent execution with shared resources and improper...

PT-2021-19424 · Mediawiki +1 · Checkuser Extension +2

Name of the Vulnerable Software and Affected Versions: MediaWiki versions through 1.35.2 Description: An issue in the CheckUser extension allows MediaWiki usernames with trailing whitespace to be stored in the cu log database table, causing denial of service for certain CheckUser extension pages...

PT-2021-2769 · Oracle +2 · Virtualbox +2

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.20 Description: The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, allowing a high-privileged attacker with logon to the infrastructure to compromise...

PT-2021-2898 · Oracle +11 · Mysql Server +10

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 5.7.33 and prior MySQL Server versions 8.0.23 and prior Description: The issue is related to insufficient input validation in the MySQL Server product of Oracle MySQL, specifically in the Server: DML component. This can ...

CVE-2020-7269 Sensitive Information Exposure in McAfee ATD

Exposure of Sensitive Information in the web interface in McAfee Advanced Threat Defense ATD prior to 4.12.2 allows remote authenticated users to view sensitive unencrypted information via a carefully crafted HTTP request parameter. The risk is partially mitigated if your ATD instances are deploy...

CVE-2021-28825 TIBCO Messaging - Eclipse Mosquitto Distribution - Core Windows Platform Installation vulnerability

The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Community Edition and TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker wit...

PT-2021-5102 · Adobe · Bridge

Name of the Vulnerable Software and Affected Versions: Adobe Bridge versions 10.1.1 and earlier Adobe Bridge versions 11.0.1 and earlier Description: The issue is related to an Improper Authorization vulnerability in the Genuine Software Service of Adobe Bridge. A low-privileged attacker could...

PT-2021-14476 · Ampache · Ampache

Name of the Vulnerable Software and Affected Versions: Ampache versions prior to 4.4.1 Description: The issue allows unauthenticated access to Ampache using the subsonic API. To exploit this, an attacker must use a username that is not part of the site to bypass the auth checks. Recommendations:...

PT-2021-18556 · Apache · Apache Solr

Name of the Vulnerable Software and Affected Versions: Apache Solr versions prior to 8.8.2 Description: The issue arises when using ConfigurableInternodeAuthHadoopPlugin for authentication. In this scenario, distributed requests are forwarded or proxied using server credentials instead of the...

PT-2021-11025

Name of the Vulnerable Software and Affected Versions: INTELBRAS TELEFONE IP TIP200 version 60.61.75.22 Description: The issue allows an attacker to obtain sensitive information through the "/cgi-bin/cgiServer.exx" API endpoint. Recommendations: For INTELBRAS TELEFONE IP TIP200 version 60.61.75.2...

PT-2021-2561 · Cisco · Cisco Unified Communications Manager Session Management Edition +1

Name of the Vulnerable Software and Affected Versions: Cisco Unified Communications Manager versions affected versions not specified Cisco Unified Communications Manager Session Management Edition versions affected versions not specified Description: The issue is related to the improper inclusion...

PT-2021-18072 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2.3-25426-3 Description: The issue is related to the improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE, allowing remote authenticated users to...

PT-2021-4051 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.7.1 Description: The issue is related to the exposure of information in WordPress, a content management system. It involves the exploitation of a block in the WordPress editor, which can expose password-protected...

PT-2021-6993 · Red Hat +2 · Resteasy +2

Name of the Vulnerable Software and Affected Versions: RESTEasy versions up to 4.6.0.Final Description: A flaw was found in RESTEasy where the endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to...

USN-4889-1: Linux kernel vulnerabilities

Adam Nichols discovered that heap overflows existed in the iSCSI subsystem in the Linux kernel. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2021-27365 Adam Nichols discovered that the iSCSI subsystem in the Linux kernel did not...

[ASA-202103-25] wpewebkit: multiple issues

Arch Linux Security Advisory ASA-202103-25 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2020-27918 CVE-2020-29623 CVE-2021-1765 CVE-2021-1789 CVE-2021-1799 CVE-2021-1801 CVE-2021-1870 Package : wpewebkit Type : multiple issues Remote : Yes Link :...

[ASA-202103-19] vivaldi: multiple issues

Arch Linux Security Advisory ASA-202103-19 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2020-27844 CVE-2021-21159 CVE-2021-21160 CVE-2021-21161 CVE-2021-21162 CVE-2021-21163 CVE-2021-21165 CVE-2021-21166 CVE-2021-21167 CVE-2021-21168 CVE-2021-21169...

[ASA-202103-24] webkit2gtk: multiple issues

Arch Linux Security Advisory ASA-202103-24 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2020-27918 CVE-2020-29623 CVE-2021-1765 CVE-2021-1789 CVE-2021-1799 CVE-2021-1801 CVE-2021-1870 Package : webkit2gtk Type : multiple issues Remote : Yes Link :...

CVE-2021-28817

The Windows Installation component of TIBCO Software Inc.'s TIBCO Rendezvous and TIBCO Rendezvous Developer Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The...