kernel: SCSI target (LIO) write to any block on ILO backstore

A flaw was found in the Linux kernel’s implementation of the Linux SCSI target host, where an authenticated attacker could write to any block on the exported SCSI device backing store. This flaw allows an authenticated attacker to send LIO block requests to the Linux system to overwrite data on t...

jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods

A flaw was found in jQuery. HTML containing \ elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity...

OESA-2021-1189 dnsmasq security update

Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It is designed to be lightweight and have a small footprint, suitable for resource constrained routers and firewalls. It has also been widely used for tethering on smartphones and portabl...

PT-2021-4118 · Hashicorp · Hashicorp Nomad +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Nomad and Nomad Enterprise versions 1.0.4 and earlier Description: The issue is related to an error in bridge networking mode, allowing ARP spoofing from other bridged tasks on the same node. This could potentially allow a remote...

DEBIAN-CVE-2021-3501

A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API, is mapped to an array index, which can be updated by a user process at anytime which could lead to an out-of-bounds write. The highest threat from this vulnerability is to data integrity and...

OESA-2021-1163 rpm security update

The RPM Package Manager RPM is a powerful package management system capability as below -building computer software from source into easily distributable packages -installing, updating and uninstalling packaged software -querying detailed information about the packaged software, whether installed...

UBUNTU-CVE-2021-20288

An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHXGETAUTHSESSIONKEY requests, it doesn't sanitize otherkeys, allowing key reuse. An attacker who can request a globalid can exploit the ability of any user to request a globalid previously associated...

openssl: CA certificate check bypass with X509_V_FLAG_X509_STRICT

A flaw was found in openssl. The flag that enables additional security checks of certificates present in a certificate chain was not enabled allowing a confirmation step to verify that certificates in the chain are valid CA certificates is bypassed. The highest threat from this vulnerability is t...

PT-2021-2649 · Siemens +1 · Simotics Connect 400 +7

Name of the Vulnerable Software and Affected Versions: APOGEE PXC Compact BACnet versions prior to V3.5.5 APOGEE PXC Compact P2 Ethernet versions prior to V2.8.20 APOGEE PXC Modular BACnet versions prior to V3.5.5 APOGEE PXC Modular P2 Ethernet versions prior to V2.8.20 Nucleus NET affected...

kernel: SCSI target (LIO) write to any block on ILO backstore

A flaw was found in the Linux kernel’s implementation of the Linux SCSI target host, where an authenticated attacker could write to any block on the exported SCSI device backing store. This flaw allows an authenticated attacker to send LIO block requests to the Linux system to overwrite data on t...

kernel: SCSI target (LIO) write to any block on ILO backstore

A flaw was found in the Linux kernel’s implementation of the Linux SCSI target host, where an authenticated attacker could write to any block on the exported SCSI device backing store. This flaw allows an authenticated attacker to send LIO block requests to the Linux system to overwrite data on t...

The vulnerability in the drivers/pci/hotplug/rpadlpar/sysfs.c file of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability in the drivers/pci/hotplug/rpadlpar/sysfs.c file of the Linux operating system is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility ...

The vulnerability of the Apache Ambari software lies in the lack of measures taken to protect the structure of web pages, allowing attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Apache Ambari software exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

UBUNTU-CVE-2021-20271

A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from th...

pki-core: XSS in the certificate search results

A flaw was found in pki-core. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting XSS attack to inject code into the search query form which can get automatically executed. The highest threat from this vulnerability is to data integrity...

The vulnerability of the samba networking interaction software library smbd lies in the lack of privilege control mechanisms and access management tools. This allows attackers to compromise data integrity.

The vulnerability of the samba networking interaction software library smbd is related to the lack of mechanisms for privilege control and access management. Exploiting this vulnerability allows an attacker to compromise data integrity...

The vulnerability of the clidfs.c, libsmb_server.c, and smbXcli_base.c components of the Samba network communication software package lies in the lack of a mechanism to verify input data. This allows attackers to compromise the integrity of the data.

The vulnerability of the clidfs.c, libsmbserver.c, and smbXclibase.c components of the Samba network communication software package is related to a lack of mechanisms for checking input data. Exploiting this vulnerability could allow an attacker to compromise the integrity of data...

The vulnerability of the signature verification function in Cisco SD-WAN vEdge Router software allows a attacker to compromise the integrity of protected information, as facilitated by the centralized network management system Cisco SD-WAN vManage.

The vulnerability of the signature verification function in Cisco SD-WAN vEdge Router software is related to errors in verifying the cryptographic signatures. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...

The vulnerability of the mpatch_apply function in the Mercuria version control software allows a attacker to compromise data integrity.

The vulnerability of the mpatchapply function in the Mercuria version control tool is related to the lack of a mechanism for checking input data. Exploiting this vulnerability allows an attacker to compromise the integrity of data...

nodejs-y18n: prototype pollution vulnerability

A flaw was found in nodejs-y18n. There is a prototype pollution vulnerability in y18n's locale functionality. If an attacker is able to provide untrusted input via locale, they may be able to cause denial of service or in rare circumstances, impact to data integrity or confidentiality...