Debian: Security Advisory (DLA-2622-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2622-1] python-django security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2622-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb April 09, 2021 https://wiki.debian.org/LTS -...

GHSA-35MM-CC6R-8FJP Cross-site scripting in actionpack

In actionpack gem = 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed in another page a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This...

Cross-site scripting in actionpack

In actionpack gem = 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed in another page a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This...

CVE-2021-30123

FFmpeg =4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code execution...

Burpsuite-Copy-As-XMLHttpRequest - Copy As XMLHttpRequest BurpSuite Extension

The extension adds a context menu to BurpSuite that allows you to copy multiple requests as Javascript's XmlHttpRequest, which simplifies PoC development when exploiting XSS. Installation download the latest JAR from releases or build manually add JAR to burpsuite using tabs: "Extender" -...

Anhui XED Software Technology Co., Ltd. XED OA exists arbitrary file download vulnerability

Anhui XED Software Technology Co., Ltd. was established on May 16, 2008. Legal representative Ru Caifeng, the company's scope of business includes: information technology in the field of software and mobile Internet application technology development, technical consulting, technical services, clo...

[SECURITY] Fedora 32 Update: atasm-1.09-1.fc32

ATasm is a 6502 command-line cross-assembler that is compatible with the original Mac/65 macro-assembler released by OSS software. Code development can now be performed using "modern" editors and compiles with lightning speed...

[SECURITY] Fedora 33 Update: atasm-1.09-1.fc33

ATasm is a 6502 command-line cross-assembler that is compatible with the original Mac/65 macro-assembler released by OSS software. Code development can now be performed using "modern" editors and compiles with lightning speed...

Wafangdian Gongji Street Kechuang Computer Service Center Station Building System Exists SQL Injection Vulnerability

Wafangdian Gongji Street Section Computer Service Center business scope includes software development, services, computers and consumables, office supplies sales. Wafangdian City Gongji Street Section Computer Service Center building system there is a SQL injection vulnerability, the attacker can...

CVE-2021-22994

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP...

Code injection

On BIG-IP versions 13.1.3.4-13.1.3.6 and 12.1.5.2, if the tmm.http.rfc.enforcement BigDB key is enabled in a BIG-IP system, or the Bad host header value is checked in the AFM HTTP security profile associated with a virtual server, in rare instances, a specific sequence of malicious requests may...

CVE-2021-22993

On BIG-IP Advanced WAF and BIG-IP ASM versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, DOM-based XSS on DoS Profile properties page. Note: Software versions which have reached End of Software Development EoSD are no...

CVE-2021-23004

CVE-2021-23004 affects BIG-IP MPTCP handling. Affects BIG-IP versions including 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3. The issue allows creation of Multipath TCP (MPTCP) forwarding flows on ...

CVE-2021-22997

On all 7.x and 6.x versions fixed in 8.0.0, BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clustering transport services, and all data used by ElasticSearch for transport is unencrypted. Note: Software versions which have reached End of Software Development...

Buffer overflow

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, a malicious HTTP response to an Advanced WAF/BIG-IP ASM virtual server with Login Page configured in its policy may trigger a buffer...

Design/Logic Flaw

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, when running in Appliance mode with Advanced WAF or BIG-IP ASM provisioned, the TMUI, also referred to as the Configuration utility,...

SQL Injection Vulnerability in Hongyang Mobile Development Platform

Ltd. is a professional provider of health informatization solutions and application software. A SQL injection vulnerability exists in Hongyang Mobile Development Platform, which can be exploited by attackers to obtain sensitive information from the database...

Fedora: Security Advisory for atasm (FEDORA-2021-681b6ea532)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Malicious commits found in PHP code repository: What you need to know

You’ve probably heard that PHP’s Git repository was recently compromised, allowing backdoors to be added to the code located there. You may also be wondering what that means, what a supply chain attack is, and how you could be affected. Read on and well lead you though a straightforward descripti...