Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4883-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4883-1 advisory. Adam Nichols discovered that heap overflows existed in the iSCSI subsystem in the Linux kernel. A local attacker could use this to cause a...

TIBCO Security Advisory: March 23, 2021 - TIBCO ActiveSpaces -2021-28824

TIBCO ActiveSpaces Windows Platform Installation vulnerability Original release date: March 23, 2021 Last revised: CVE-2021-28824 Source: TIBCOSoftware Inc. Products Affected TIBCO ActiveSpaces - Community Edition versions 4.5.0 and below TIBCO ActiveSpaces - Developer Edition versions 4.5.0 and...

PT-2021-2512 · Apache · Apache Ofbiz

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 17.12.06 Description: The issue is related to unsafe deserialization in Apache OFBiz, allowing an unauthenticated attacker to take over the system. This can impact the confidentiality, integrity, and availabilit...

Ubuntu: Security Advisory (USN-4883-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-20676

M-System DL8 series type A DL8-A versions prior to Ver3.0, type B DL8-B versions prior to Ver3.0, type C DL8-C versions prior to Ver3.0, type D DL8-D versions prior to Ver3.0, and type E DL8-E versions prior to Ver3.0 allows remote authenticated attackers to bypass access restriction and conduct...

CVE-2021-20633

Improper access control vulnerability in Cabinet of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the date of Cabinet via unspecified vectors...

Improper access control

Improper access control vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the date of Custom App via unspecified vectors...

CVE-2021-20676

CVE-2021-20676 concerns the M-System DL8 series (types A–E) prior to firmware Ver3.0. The vulnerability allows remote authenticated attackers to bypass access restrictions and perform prohibited operations via unspecified vectors. Affected products include DL8-A/B/C/D/E before Ver3.0; impact is t...

CVE-2021-20676

M-System DL8 series type A DL8-A versions prior to Ver3.0, type B DL8-B versions prior to Ver3.0, type C DL8-C versions prior to Ver3.0, type D DL8-D versions prior to Ver3.0, and type E DL8-E versions prior to Ver3.0 allows remote authenticated attackers to bypass access restriction and conduct...

CVE-2021-20633

Improper access control vulnerability in Cabinet of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the date of Cabinet via unspecified vectors...

CVE-2020-24877

A SQL injection vulnerability in zzzphp v1.8.0 through /form/index.php?module=getjson may lead to a possible access restriction bypass...

Sql injection

A SQL injection vulnerability in zzzphp v1.8.0 through /form/index.php?module=getjson may lead to a possible access restriction bypass...

CVE-2020-24877

CVE-2020-24877 describes a SQL injection in zzzphp v1.8.0 via /form/index.php?module=getjson, causing an access restriction bypass. Multiple connected sources confirm the vulnerable component and the root cause: insufficient validation/escaping of external input in SQL statements. Reported impact...

CVE-2020-24877

A SQL injection vulnerability in zzzphp v1.8.0 through /form/index.php?module=getjson may lead to a possible access restriction bypass...

PT-2021-1512 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.11.6 Description: An issue was discovered in the Linux kernel where the fastrpc internal invoke function in drivers/misc/fastrpc.c does not prevent user applications from sending kernel RPC messages. This coul...

[ASA-202103-5] minio: access restriction bypass

Arch Linux Security Advisory ASA-202103-5 ========================================= Severity: Medium Date : 2021-03-13 CVE-ID : CVE-2021-21362 Package : minio Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-1664 Summary ======= The package minio before...

VM Backups <= 1.0 - CSRF to Database Backup Download

The plugin does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the DB, plugins, and current theme. The files will be created in the uploads directory by default, with a timestamp in their filenames, without any access restriction,...

PT-2021-7335 · Avahi +8 · Avahi +8

Name of the Vulnerable Software and Affected Versions: Avahi versions 0.6 up to 0.8 Description: The issue is related to the client work function in the Avahi service discovery system, which can lead to an infinite loop due to a condition with no exit. This can be exploited by an attacker to caus...

Database Backups <= 1.2.2.6 - CSRF to Backup Download

The plugin does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the database, change the plugin's settings and delete backups. When generating a backup, the file is created in the /wp-content/uploads/database-backups directory, with ...

PT-2021-7092

Name of the Vulnerable Software and Affected Versions Atlassian Confluence Server and Data Center versions prior to 7.4.17 Atlassian Confluence Server and Data Center versions 7.13.0 through 7.13.6 Atlassian Confluence Server and Data Center versions 7.14.0 through 7.14.2 Atlassian Confluence...