Security Bulletin: IBM App Connect Enterprise Certified Container Designers may be vulnerable to arbitrary code execution via CVE-2021-3757

Summary IBM App Connect Enterprise Certified Container may be vulnerable to arbitrary code execution via CVE-2021-3757. This only affects App Connect Designers Vulnerability Details CVEID: CVE-2021-3757 DESCRIPTION: Node.js immer module could allow a remote attacker to execute arbitrary code on t...

Security Bulletin: IBM App Connect Enterprise Certified Container could disclose sensitive information to a local user when it is configured to use an IBM Cloud API key to connect to cloud-based connectors (CVE-2021-29906)

Summary IBM App Connect Enterprise may include the hash of an IBM Cloud API key that is used by an Integration Server in the Pod definition of that Integration Server. This is only present if the Integration Server is configured to communicate with the cloud-based connectors in a cloud instance o...

CVE-2021-38398

The affected device uses off-the-shelf software components that contain unpatched vulnerabilities. A malicious attacker with physical access to the affected device could exploit these vulnerabilities...

Pixel Update Bulletin—October 2021Stay organized with collectionsSave and categorize content based on your preferences.

The Pixel Update Bulletin contains details of security vulnerabilities and functional improvements affecting supported Pixel devices Google devices. For Google devices, security patch levels of 2021-10-05 or later address all issues in this bulletin and all issues in the October 2021 Android...

CVE-2021-38398

The affected device uses off-the-shelf software components that contain unpatched vulnerabilities. A malicious attacker with physical access to the affected device could exploit these vulnerabilities...

Security Bulletin: IBM Disconnected Log Collector is vulnerable to using components with known vulnerabilities (CVE-2016-3506, CVE-2020-13692)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. Vulnerability Details CVEID: CVE-2016-3506 DESCRIPTION: An unspecified vulnerability in multiple Oracle products could allow an unauthenticated attacker to take...

The 2021 OWASP Top 10 Have Evolved: Here's What You Should Know

Late last week, the Open Web Application Security Project OWASP released its top 10 list of critical web application security risks. The last OWASP Top 10 came out in 2017, and in the intervening 4 years, we've seen a fundamental shift in application security that includes greater emphasis on...

New Tomiris Backdoor Found Linked to Hackers Behind SolarWinds Cyberattack

Cybersecurity researchers on Wednesday disclosed a previously undocumented backdoor likely designed and developed by the Nobelium advanced persistent threat APT behind last year's SolarWinds supply chain attack, joining the threat actor's ever-expanding arsenal of hacking tools...

Confluent Ansible security vulnerabilities

Confluent Ansible is a product from the US-based Confluent, Inc. It provides an easy way to deploy, manage and configure Confluent Platform services. A security vulnerability exists in Confluent Ansible cp-ansible versions 5.5.0, 5.5.1, 5.5.2, and 6.0.0, in which its auxiliary components are...

DongTai - An Interactive Application Security testing(IAST) Product That Supports The Detection Of OWASP WEB TOP 10 Vulnerabilities, Multi-Request Related Vulnerabilities (Including Logic Vulnerabilities, Unauthorized Access Vulnerabilities, Etc.), Third-Party Component Vulnerabilities, Etc.

中文版本Chinese version About DongTai IAST DongTai IAST is an open-source passive interactive security testing IAST product. It uses dynamic hooks and taint tracking algorithms to achieve universalvulnerability detection and multiples request associated withvulnerability detection including but not...

YzmCMS Cross-site Request Forgery Vulnerability (CNVD-2021-90912)

YzmCMS is a lightweight open source content management system based on PHP Mysql architecture developed solely by Yuan Zhimeng. A cross-site request forgery vulnerability exists in /controller/pay.class.php in YzmCMS version 5.5. An attacker can use this vulnerability to access sensitive componen...

CVE-2020-19951

A cross-site request forgery CSRF in /controller/pay.class.php of YzmCMS v5.5 allows attackers to access sensitive components of the application...

CVE-2020-19951

A cross-site request forgery CSRF in /controller/pay.class.php of YzmCMS v5.5 allows attackers to access sensitive components of the application...

YzmCMS v5.5/controller/pay.class.php component has a cross-site request forgeing vulnerability

YzmCMS is a lightweight open source content management system based on PHP Mysql architecture developed solely by Yuan Zhimeng. A cross-site request forgery vulnerability exists in /controller/pay.class.php in YzmCMS version 5.5. An attacker can use this vulnerability to access sensitive componen...

CVE-2020-19951: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF in /controller/pay.class.php of YzmCMS v5.5 allows attackers to access sensitive components of the application...

CVE-2020-21913

A use after free flaw was discovered in the International Components for Unicode icu file tools package pkgdata. The highest threat from this vulnerability is to system availability...

CVE-2021-41086

jsuites is an open source collection of common required javascript web components. In affected versions users are subject to cross site scripting XSS attacks via clipboard content. jsuites is vulnerable to DOM based XSS if the user can be tricked into copying anything from a malicious and pasting...

CVE-2021-41086

jsuites is an open source collection of common required javascript web components. In affected versions users are subject to cross site scripting XSS attacks via clipboard content. jsuites is vulnerable to DOM based XSS if the user can be tricked into copying anything from a malicious and pasting...

CVE-2021-41086

CVE-2021-41086 affects the jsuites project. The vulnerability is a DOM-based XSS triggered when clipboard content is pasted into an HTML editor, because part of the clipboard content is written directly to innerHTML. The attacker must entice the user to copy arbitrary content and paste it. Impact...

ALSA-2021:3590 Moderate: mysql:8.0 security, bug fix, and enhancement update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and libraries. The following packages have been upgraded to a later upstream version: mysql 8.0.26. BZ1996693 Security Fixes: mysql: Server: Stored Procedure multiple...