CVE-2021-42855

CVE-2021-42855 affects the SteelCentral AppInternals Dynamic Sampling Agent (DSA). The issue stems from a configuration file named .debug_command.config that stores a JSON string listing IDs and pre-configured commands. This file is read by the API endpoint /api/appInternals/1.0/agent/configurati...

CVE-2021-42853

CVE-2021-42853 concerns directory traversal in the SteelCentral AppInternals Dynamic Sampling Agent (DSA), specifically the AgentDiagnosticServlet at the /api/appInternals/1.0/agent/diagnostic/logs endpoint. The root cause, as described in the sources, is that this endpoint performs no input vali...

CVE-2021-42853 Directory Traversal Delete/Read at AgentDiagnosticServlet

It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's DSA AgentDiagnosticServlet has directory traversal vulnerability at the "/api/appInternals/1.0/agent/diagnostic/logs" API. The affected endpoint does not have any input validation of the user's input that allows a...

Debian DSA-5094-1 : thunderbird - security update

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5094 advisory. - An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild...

Debian: Security Advisory (DSA-5091-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-5093-1 : spip - security update

The remote Debian 10 / 11 host has a package installed that is affected by a vulnerability as referenced in the dsa-5093 advisory. It was discovered that SPIP, a website engine for publishing, would allow a malicious user to execute arbitrary code. For the oldstable distribution buster, this...

EulerOS 2.0 SP9 : nss (EulerOS-SA-2022-1294)

According to the versions of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - NSS Network Security Services versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS...

EulerOS 2.0 SP9 : nss (EulerOS-SA-2022-1310)

According to the versions of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - NSS Network Security Services versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS...

Huawei EulerOS: Security Advisory for nss (EulerOS-SA-2022-1310)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP5 : nss (EulerOS-SA-2022-1278)

According to the versions of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - NSS Network Security Services versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS...

GSD-2022-1000519 net: dsa: fix panic when DSA master device unbinds on shutdown

net: dsa: fix panic when DSA master device unbinds on shutdown This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.10 by commit...

GSD-2022-1000513 net: dsa: lantiq_gswip: don't use devres for mdiobus

net: dsa: lantiqgswip: don't use devres for mdiobus This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.10 by commit...

GSD-2022-1000508 net: dsa: ar9331: register the mdiobus under devres

net: dsa: ar9331: register the mdiobus under devres This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.10 by commit...

GSD-2022-1000464 net: dsa: lantiq_gswip: fix use after free in gswip_remove()

net: dsa: lantiqgswip: fix use after free in gswipremove This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.25 by commit...

GSD-2022-1000437 net: dsa: mv88e6xxx: fix use-after-free in mv88e6xxx_mdios_unregister

net: dsa: mv88e6xxx: fix use-after-free in mv88e6xxxmdiosunregister This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.24 by commit...

GSD-2022-1000429 net: dsa: bcm_sf2: don't use devres for mdiobus

net: dsa: bcmsf2: don't use devres for mdiobus This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.24 by commit...

GSD-2022-1000428 net: dsa: mv88e6xxx: don't use devres for mdiobus

net: dsa: mv88e6xxx: don't use devres for mdiobus This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.24 by commit...

GSD-2022-1000370 net: dsa: bcm_sf2: don't use devres for mdiobus

net: dsa: bcmsf2: don't use devres for mdiobus This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.101 by commit...

GSD-2022-1000368 net: dsa: mv88e6xxx: don't use devres for mdiobus

net: dsa: mv88e6xxx: don't use devres for mdiobus This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.101 by commit...

Debian DSA-5086-1 : thunderbird - security update

The remote Debian 10 / 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5086 advisory. An out-of-bounds write was discovered in Thunderbird, which could be triggered via a malformed email message. For the oldstable distribution buster, this problem has...