The vulnerability of the OverlayFS component arises from the Firejail jailer’s SUID status. This vulnerability stems from insufficient checks on the state of shared resources. As a result, attackers can gain access to confidential data, compromise its integrity, and even cause service failures.

The vulnerability of the OverlayFS component in Firejail’s SUID mode is related to insufficient checking of the status of shared resources. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of Google Chrome browser extensions, related to improper authorization, allows a perpetrator to compromise data integrity.

The vulnerability of Google Chrome browsers is related to the insufficient implementation of policies. Exploiting this vulnerability allows a malicious actor to compromise data integrity remotely...

The vulnerability of the Ceph storage system, related to the lack of protective measures for the website structure, allows attackers to compromise the integrity of the data.

The vulnerability of the Ceph storage system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to compromise the integrity of the data...

The vulnerability of the Apache HTTP Server web server arises from insufficient validation of input data, allowing attackers to compromise the integrity of protected information.

The vulnerability of the Apache HTTP Server exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to compromise the integrity of the protected information from a remote location...

The vulnerability of the FreeBSD operating system’s kernel, related to deficiencies in the authentication mechanism, allows a perpetrator to disable the SMAP protection and compromise the integrity of the protected information.

The vulnerability of the FreeBSD operating system’s kernel is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to disable the SMAP protection and compromise the integrity of the protected information during system calls...

The vulnerability of the runc tool’s configuration allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the configuration of the tool for running isolated containers, “runc,” exists due to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and...

Security Bulletin: Vulnerability in jackson-databind affects Cloud Pak System (CVE-2020-25649)

Summary Vulnerability in jackson-databind affects Cloud Pak System. IBM Cloud Pak System adressed vulnerabilities. Vulnerability Details CVEID: CVE-2020-25649 DESCRIPTION: FasterXML Jackson Databind could provide weaker than expected security, caused by not having entity expansion secured properl...

CVE-2019-20444

A HTTP smuggling flaw was found in HttpObjectDecoder.java in Netty in versions prior to version 4.1.44. HTTP headers with an invalid fold, in this case CRLF carriage return, line feed without being followed by SP space or HTAB horizontal tab, result in situations where headers can be misread. Dat...

Important: kernel

Issue Overview: A vulnerability was found in the bluez, where Passkey Entry protocol used in Secure Simple Pairing SSP, Secure Connections SC and LE Secure Connections LESC of the Bluetooth Core Specification is vulnerable to an impersonation attack where an active attacker can impersonate the...

openSUSE 15 Security Update : postgresql13 (openSUSE-SU-2021:1785-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1785-1 advisory. - A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certai...

Amazon Linux 2 : rpm (ALAS-2021-1689)

The version of rpm installed on the remote host is prior to 4.11.3-40. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1689 advisory. A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can...

PT-2021-6606 · Hashicorp +2 · Hashicorp Consul +3

Name of the Vulnerable Software and Affected Versions: HashiCorp Consul and Consul Enterprise versions 1.3.0 through 1.10.0 Description: The issue is related to the absence of validation of the destination service identity in the encoded subject alternative name in the Envoy proxy TLS...

CVE-2021-20303

There is a flaw in OpenEXR's dataWindowForTile function. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger an integer overflow, leading to an out-of-bounds write on the heap. The greatest impact of this flaw is to application availability, with some potenti...

wildfly: XSS via admin console when creating roles in domain mode

A flaw was found in Wildfly. While creating a new role in the domain mode via the admin console, it is possible to add a payload in the name field, leading to a Cross-site scripting attack XSS. The highest threat from this vulnerability is to confidentiality and integrity...

The vulnerability of the urllib2 module in the Python programming language, related to the failure to eliminate the crlf sequence, allows attackers to compromise data integrity.

The vulnerability of the urllib2 module in the Python programming language is related to the lack of measures taken to neutralize the crlf sequence. Exploiting this vulnerability can allow an attacker to compromise data integrity remotely...

Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2021-2179)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the `translate` function in the Ruby on Rails software platform translation_helper.rb allows attackers to exploit it to compromise the integrity of web pages’ structures.

The vulnerability of the translate function in the Ruby on Rails software platform, translationhelper.rb, is related to deficiencies in the security measures used to protect web page structures. Exploiting this vulnerability allows an attacker to compromise data integrity...

EulerOS Virtualization 2.9.1 : rpm (EulerOS-SA-2021-2186)

According to the versions of the rpm packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a...

Medium: httpd24

Issue Overview: A flaw was found in Apache httpd. The modproxywstunnel module tunnels non-upgraded connections. CVE-2019-17567 A flaw was found in HTTPd. In some Apache HTTP Server versions, unprivileged local users can stop HTTPd on Windows. The highest threat from this vulnerability is to syste...

The vulnerability in the Safari_init.php function of the Machform form creation PHP editor allows a attacker to compromise the confidentiality and integrity of the protected information.

The vulnerability in the Safariinit.php function of the Machform form creation PHP editor is related to the use of open redirection. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...