Security update for alpine (moderate)

openSUSE Security Update: Security update for alpine Announcement ID: openSUSE-SU-2021:0695-1 Rating: moderate References: 1173281 Cross-References: CVE-2020-14929 CVSS scores: CVE-2020-14929 NVD : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2020-14929 SUSE: 7.5...

zstd:dictionary_stream_round_trip: Crash in MEM_read32

Project: https://github.com/facebook/zstd.git Detailed Report: https://oss-fuzz.com/testcase?key=5589301472657408 Project: zstd Fuzzing Engine: honggfuzz Fuzz Target: dictionarystreamroundtrip Job Type: honggfuzzasanzstd Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x62f10000b1a0...

The Account Takeover Threat: A By-the-Numbers Breakdown

Identity theft has come a long way in the age of technology. The more data is available online, the greater the threat. In this blog we will dive into the different characteristics and statistics of real world Account Takeover attacks as recorded and mitigated by Imperva’s Advanced Bot Protection...

Fixed in ClickHouse 21.4.3.21, 2021-04-12 

An attacker that has CREATE DICTIONARY privilege, can read arbitary file outside permitted directory...

PT-2021-6811 · Yandex +1 · Yandex Browser +1

Name of the Vulnerable Software and Affected Versions: ClickHouse versions prior to v20.8.18.32-lts ClickHouse versions prior to v21.1.9.41-stable ClickHouse versions prior to v21.2.9.41-stable ClickHouse versions prior to v21.3.6.55-lts ClickHouse versions prior to v21.4.3.21-stable Yandex Brows...

CVE-2021-25263

An attacker that has CREATE DICTIONARY privilege, can read arbitary file outside permitted directory. Fix has been pushed to versions 20.8.18.32-lts, 21.1.9.41-stable, 21.2.9.41-stable, 21.3.6.55-lts, 21.4.3.21-stable and later. Vyacheslav Egoshin...

Open-Xchange: Path Traversal in dict-fs and no-check Escape Character in oauth2-jwt

0x01 Path Traversal in dict-fs module If we use fs to store dictionaries, when program get the value of key: static int fsdictlookupstruct dict dict, poolt pool, const char key, const char valuer, const char errorr struct fsdict dict = struct fsdict dict; struct fsfile file; struct istream input;...

Prototype Pollution

style-dictionary is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

CVE-2021-26702

EPrints 3.4.2 exposes a reflected XSS opportunity in the dataset parameter to the cgi/datasetdictionary URI...

@fluentui/token-pipeline (>=0.3.3, <=0.22.0), @inmotionnow/momentum-components (>=8.2.2-next.2, <=102.39.0) +7 more potentially affected by unknown CVE via style-dictionary (>=2.5.0, <=2.10.2)

style-dictionary NPM version =2.5.0, =0.3.3, =8.2.2-next.2, =1.0.2, =0.1.0, =0.0.2, =1.0.0, =8.1.3, =6.0.0, =8.2.2-next.2 Source cves: unknown CVE Source advisory: SNYK:JS-STYLEDICTIONARY-1080632...

Prototype Pollution

Overview style-dictionary is a Style once, use everywhere. A build system for creating cross-platform styles. Affected versions of this package are vulnerable to Prototype Pollution. PoC const StyleDictionary = require'style-dictionary'; const obj = ; let opts =...

PT-2021-17099

Name of the Vulnerable Software and Affected Versions EPrints version 3.4.2 Description The issue allows for a reflected XSS opportunity. This is due to the dataset parameter in the "cgi/dataset dictionary" URI being vulnerable. Recommendations For EPrints version 3.4.2, update to a newer version...

Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2021-1357)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-21253

OnlineVotingSystem is an open source project hosted on GitHub. OnlineVotingSystem before version 1.1.2 hashes user passwords without a salt, which is vulnerable to dictionary attacks. Therefore there is a threat of security breach in the voting system. Without a salt, it is much easier for...

CVE-2021-21253

OnlineVotingSystem is an open source project hosted on GitHub. OnlineVotingSystem before version 1.1.2 hashes user passwords without a salt, which is vulnerable to dictionary attacks. Therefore there is a threat of security breach in the voting system. Without a salt, it is much easier for...

Information disclosure

OnlineVotingSystem is an open source project hosted on GitHub. OnlineVotingSystem before version 1.1.2 hashes user passwords without a salt, which is vulnerable to dictionary attacks. Therefore there is a threat of security breach in the voting system. Without a salt, it is much easier for...

CVE-2021-21253

OnlineVotingSystem is an open source project hosted on GitHub. OnlineVotingSystem before version 1.1.2 hashes user passwords without a salt, which is vulnerable to dictionary attacks. Therefore there is a threat of security breach in the voting system. Without a salt, it is much easier for...

CVE-2021-21253

OnlineVotingSystem is an open source project hosted on GitHub. OnlineVotingSystem before version 1.1.2 hashes user passwords without a salt, which is vulnerable to dictionary attacks. Therefore there is a threat of security breach in the voting system. Without a salt, it is much easier for...

CVE-2021-21253 Use of a One-Way Hash without a Salt in OnlineVotingSystem

OnlineVotingSystem is an open source project hosted on GitHub. OnlineVotingSystem before version 1.1.2 hashes user passwords without a salt, which is vulnerable to dictionary attacks. Therefore there is a threat of security breach in the voting system. Without a salt, it is much easier for...

CVE-2021-21253

CVE-2021-21253 concerns OnlineVotingSystem, an open-source project. The vulnerability affects versions prior to 1.1.2 where user passwords are hashed without a salt, making them susceptible to dictionary attacks (e.g., rainbow tables). The root cause is the absence of a long randomly generated sa...