CVE-2021-26726

A remote code execution vulnerability affecting a Valmet DNA service listening on TCP port 1517, allows an attacker to execute commands with SYSTEM privileges This issue affects: Valmet DNA versions from Collection 2012 until Collection 2021...

Incorrect Authorization in Apache Solr

In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all...

GHSA-J346-H5WC-RW2M Incorrect Authorization in Apache Solr

In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all...

CVE-2021-43859 Denial of Service by injecting highly recursive collections or maps in XStream

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulatin...

Denial of Service by injecting highly recursive collections or maps in XStream

Impact The vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. Patches XStream 1.4.19 monitors and accumulates the...

GHSA-RMR5-CPV2-VGJF Denial of Service by injecting highly recursive collections or maps in XStream

Impact The vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. Patches XStream 1.4.19 monitors and accumulates the...

Mageia: Security Advisory (MGASA-2021-0131)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2019-0399)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GLSA-202107-37 : Apache Commons Collections: Remote code execution

The remote host is affected by the vulnerability described in GLSA-202107-37 Apache Commons Collections: Remote code execution Some classes in the Apache Commons Collections functor package deserialized potentially untrusted input by default. Impact : Deserializing untrusted input using Apache...

Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

Description Reflected cross site scripting vulnerability in pimpore/pimcore , it is in group field in Field collections and objectbricks in settings module. Proof of Concept 1 .Login to demo account 2 . Go to settings module --data objects --object bricks or Field collection -- edit any one and a...

RHEL 7 : Satellite 6.10 Release (Moderate) (RHSA-2021:4702)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4702 advisory. Red Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring...

Moderate: Red Hat Security Advisory: Satellite 6.10 Release

An update is now available for Red Hat Satellite 6.10 for RHEL 7. Red Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring of multiple Linux deployments with a single centralized tool. Security Fixes: python-ecdsa...

libsolv security and bug fix update

0.7.19-1 - Update to 0.7.19 - repoaddconda: add flag to skip v2 packages - fix rare segfault in resolvejobrules that could happen if new rules are learnt - fix error handling in solvxfopenfd - fix memory leaks 0.7.17-2 - Fix rpm dependency 0.7.17-1 - Update to 0.7.17 - selected bug fixes:...

org.neo4j:neo4j-graph-collections (0.3) potentially affected by CVE-2021-34371 via org.neo4j:neo4j (1.7)

org.neo4j:neo4j MAVEN version 1.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - org.neo4j:neo4j-graph-collections 0.3 Source cves: CVE-2021-34371 Source advisory: OSV:GHSA-PC4W-8V5J-29W9...

arc-swap (>=0.3.1, <=0.4.5), ipld-collections (>=0.1.0, <=0.3.0) +2 more potentially affected by CVE-2020-36460 via model (>=0.0.4, <=0.1.2)

model CARGO version =0.0.4, =0.3.1, =0.1.0, =0.13.0, =0.0.1, =0.1.5 Source cves: CVE-2020-36460 Source advisory: GHSA-MXV6-Q98X-H958...

arc-swap (>=0.3.1, <=0.4.5), ipld-collections (>=0.1.0, <=0.3.0) +2 more potentially affected by CVE-2020-36460 via model (>=0.0.4, <=0.1.2)

model CARGO version =0.0.4, =0.3.1, =0.1.0, =0.13.0, =0.0.1, =0.1.5 Source cves: CVE-2020-36460 Source advisory: OSV:GHSA-MXV6-Q98X-H958...

CVE-2021-3681

A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in the repository directory that are not explicitly excluded via the buildignore list in "galaxy.yml" include files in the .tar.gz file. This contains sensitive info, such as the user's Ansible Galaxy A...

Ansible Galaxy Collections security vulnerabilities

Red Hat Ansible is a computer system configuration manager from Red Hat, an American company. The product can be used to distribute, manage, and organize computer systems. A security vulnerability exists in Ansible Galaxy Collections that can be exploited by an attacker to obtain sensitive system...

DELL EMC Repository Manager has an unspecified vulnerability

DELL EMC Repository Manager is an application within the Dell OpenManage product portfolio from Dell USA that allows IT administrators to easily manage system updates.Dell Repository Manager provides a searchable interface for creating custom software collections that are A security vulnerability...

Apache Commons Collections: Remote code execution

Background Apache Commons Collections extends the JCF classes with new interfaces, implementations and utilities. Description Some classes in the Apache Commons Collections functor package deserialized potentially untrusted input by default. Impact Deserializing untrusted input using Apache Commo...