EulerOS 2.0 SP3 : rpm (EulerOS-SA-2021-2613)

According to the versions of the rpm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to...

EulerOS 2.0 SP3 : OpenEXR (EulerOS-SA-2021-2600)

According to the versions of the OpenEXR package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw found in function dataWindowForTile of IlmImf/ImfTiledMisc.cpp. An attacker who is able to submit a crafted file to be processed by OpenE...

EulerOS 2.0 SP3 : cifs-utils (EulerOS-SA-2021-2575)

According to the versions of the cifs-utils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos...

EulerOS 2.0 SP3 : samba (EulerOS-SA-2021-2615)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in samba. Spaces used in a string around a domain name DN, while supposed to be ignored, can cause invalid DN strings with space...

CVE-2021-21703

php-fpm has a vulnerability which may lead to local privilege escalation. This vulnerability is hard to exploit as the attack needs to escape the FPM sandbox mechanism. When a complete attack is achieved it may lead to risk for confidentiality, data integrity, and system availability...

maven: Block repositories using http by default

A flaw was found in maven. Repositories that are defined in a dependency’s Project Object Model pom, which may be unknown to users, are used by default resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that...

AZL-6722 CVE-2021-35630 affecting package mysql for versions less than 8.0.28-1

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Options. Supported versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attac...

CVE-2021-35630

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Options. Supported versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attac...

CVE-2021-35630

CVE-2021-35630 affects Oracle MySQL Server 8.0.26 and earlier (component: Server: Options). The vulnerability allows a high-privilege attacker with network access via multiple protocols to perform unauthorized data creation, deletion, or modification. Remediation: upgrade to a newer MySQL 8.0 rel...

CVE-2021-35541

CVE-2021-35541 affects Oracle PeopleSoft Enterprise SCM, Supplier Portal, version 9.2. The vulnerability is described as information disclosure/unauthorized data modification with low-privilege, network-accessible (HTTP) access requiring user interaction, and may impact additional PeopleSoft prod...

Oracle E-Business Suite 安全漏洞

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management, and other functions. A security vulnerability exists in the Oracle Deal...

jetty: SessionListener can prevent a session from being invalidated breaking logout

A flaw was discovered in the jetty-server, where if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts, this could result in a session not being...

Denial Of Service (DoS)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Roles. Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...

SAP NetWeaver AS 安全漏洞

SAP NetWeaver AS is a SAP network application server from SAP. It not only provides network services, but is also the basic platform for SAP software. SAP NetWeaver AS ABAP and ABAP Platform versions 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756 have a security vulnerabilit...

CVE-2021-42013

A path traversal and remote code execution flaw was found in Apache HTTP Server 2.4.49 and 2.4.50. A remote attacker could use this flaw to map URLs to files outside the expected document root. Additionally, this flaw could leak the source of interpreted files like CGI scripts. If files outside o...

samba: Negative idmap cache entries can cause incorrect group entries in the Samba file server process token

A flaw was found in samba. The Samba smbd file server must map Windows group identities SIDs into unix group ids gids. The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache...

The vulnerability of the XMPP Dino chat client, related to deficiencies in path name limitation, allows attackers to compromise data integrity.

The vulnerability of the XMPP Dino chat client is related to a bug in URI-encoded path separators. Exploiting this vulnerability could allow an attacker to compromise data integrity remotely...

The vulnerability of software for performing virtualization at the operating system level, also known as containerization, Singularity, arises from insufficient checking of unusual or exceptional states. This allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of software for performing virtualization at the operating system level, also known as containerization, is related to improper checking of the return value of functions. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data, compromise it...

The vulnerability of the Double Ratchet Libolm cryptographic ratchet implementation lies in the possibility of data being written beyond the buffer boundaries. This allows attackers to gain access to confidential data, compromise its integrity, and even cause service failures.

The vulnerability of the Double Ratchet Libolm cryptographic ratchet implementation lies in the writing beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker operating remotely to gain access to confidential data, compromise its integrity, and even cause service...

The vulnerability of the Eterm, Mrxyt, Rxyt-unicode software lies in their SSL-Proxy function, which allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Eterm, Mrxyt, Rxyt, and Rxyt-unicode software lies in the improper handling of certain control sequences. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its integrity, and cause service failures...