Microsoft Access Code Execution

The vulnerability of Microsoft Access components in Microsoft Office and Microsoft 365 apps is related to improper code generation. Exploiting this vulnerability allows an attacker to execute arbitrary code through a specially crafted request...

Portals Components Escape Isolated Environment

The vulnerability of the Portals components in Google Chrome and Microsoft Edge is related to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to escape from an isolated software environment remotely...

bentodev (>=0.1.17, <=2018.11.2), clacks (0.1.1.dev845) +6 more potentially affected by CVE-2021-3572 via pip (9.0.1)

pip PYPI version 9.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - bentodev =0.1.17, =2.4.0, =0.2.0, =0.1.4, =1.2.0, =1.11.0 Source cves: CVE-2021-3572 Source advisory: OSV:GHSA-5XP3-JFQ3-5Q8X...

PT-2021-6433 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.27 and prior Description: The issue is related to insufficient input validation in the MySQL Server component, specifically in the Server: Components Services. This can be exploited by a remote attacker to cause a...

CVE-2021-30259

Possible out of bound access due to improper validation of function table entries in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure...

CVE-2021-34417

The network proxy page on the web portal for the Zoom On-Premise Meeting Connector Controller before version 4.6.365.20210703, Zoom On-Premise Meeting Connector MMR before version 4.6.365.20210703, Zoom On-Premise Recording Connector before version 3.8.45.20210703, Zoom On-Premise Virtual Room...

jasper: Heap-based buffer over-read in jp2_decode() in jp2_dec.c

jp2decode in jp2/jp2dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components...

new packages: gcc-toolset-11-dwz

GCC Toolset is a compiler toolset that provides recent versions of development tools. GCC Toolset is an Application Stream packaged as a Software Collection. This enhancement update adds the gcc-toolset-11-dwz packages to AlmaLinux For instructions on usage, see Using GCC Toolset linked from the...

OWASP Top 10 Deep Dive: Getting a Clear View on Vulnerable and Outdated Components

Most of us think of climbing the ladder as a good thing — but when the ladder in question is OWASP's Top 10 list of application security risks, a sudden upward trajectory is cause for alarm rather than encouragement. In the 2021 edition of the OWASP list, vulnerable and outdated components moved ...

Prototype Pollution in node-jsonpointer

This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays...

Mozilla Firefox Security Advisory (MFSA2021-20) - Linux

The remote host is missing an update for Mozilla Firefox, announced via the advisory MFSA2021-20. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...

CVE-2021-23820

This affects all versions of package json-pointer. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer components are arrays...

Type confusion

This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays...

CVE-2021-23820: Access of Resource Using Incompatible Type

This affects all versions of package json-pointer. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer components are arrays...

Trend Micro Multiple Products Content Validation Escape Vulnerability

Trend Micro Apex One, OfficeScan, and Worry-Free Business Security agents contain a content validation escape vulnerability that could allow an attacker to manipulate certain agent client components...

Android Patches Actively Exploited Zero-Day Kernel Bug

Among Google’s November Android security updates is a patch for a zero-day weakness that “may be under limited, targeted exploitation,” the company said. Out of this month’s batch of 39 patches, 18 of them plug flaws in the framework and system components and another 18 address vulnerabilities in...

Multiple Qualcomm product vulnerabilities involving buffer errors

Qualcomm MDM9206 and others are products of Qualcomm Incorporated Qualcomm.MDM9206 is a central processing unit CPU product.MDM9607 is a central processing unit CPU product.MDM9640 is a central processing unit CPU product.MDM9640 is a central processing unit CPU product.MDM9640 is a central...

Multiple Qualcomm products have security vulnerabilities

The Qualcomm QCA6574AU and others are products of Qualcomm Incorporated, U.S.A. The QCA6574AU is a central processing unit CPU product.The SDX24 is a modem.The SDX55 is a modem.The QCA6574AU is a central processing unit CPU product.The SDX24 is a modem.The SDX55 is a modem. A security vulnerabili...

Multiple Qualcomm product resource management error vulnerabilities

Qualcomm MDM9206 and others are products of Qualcomm Incorporated Qualcomm, U.S.A. The MDM9206 is a central processing unit CPU product.The MDM9650 is a central processing unit CPU product.The MSM8996AU is a central processing unit CPU product. A resource management error vulnerability exists in...

PT-2021-8000

Name of the Vulnerable Software and Affected Versions jsonpointer versions prior to 5.0.0 Description A type confusion issue in the jsonpointer package can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays. This can potentially allow a remote attacker t...