Huawei EulerOS: Security Advisory for java-1.8.0-openjdk (EulerOS-SA-2021-2933)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP5 : java-1.8.0-openjdk (EulerOS-SA-2021-2933)

According to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Swing. Supported versions that...

GitLab Community and Enterprise Cross-Site Scripting (CVE-2021-22241)

A stored cross-site scripting vulnerability exists in the Community edition and Enterprise edition of GitLab. The vulnerability is due to improper input validation of the default branch name...

CVE-2021-20874

Incorrect permission assignment for critical resource vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier allows a remote unauthenticated attacker to access arbitrary files on the server and obtain...

Path traversal

Path traversal vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier allows an attacker with an administrative privilege to obtain sensitive information stored in the hierarchy above the directory on...

CVE-2021-20876

CVE-2021-20876 is a path traversal flaw in GroupSession products (Free edition v5.1.1 and earlier, byCloud v5.1.1 and earlier, ZION v5.1.1 and earlier) that could allow an administrator to access sensitive files outside the web root on the published site via unspecified vectors. The issue affects...

CVE-2021-20875

CVE-2021-20875 is an open redirect vulnerability in GroupSession products (Free edition v5.1.1 and earlier, byCloud v5.1.1 and earlier, ZION v5.1.1 and earlier). The root cause is input validation that allows a specially crafted URL to redirect users to arbitrary sites, enabling phishing when use...

CVE-2021-20876: Improper Limitation of a Pathname to a Restricted Directory

Path traversal vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier allows an attacker with an administrative privilege to obtain sensitive information stored in the hierarchy above the directory on...

CVE-2021-20874: Incorrect Permission Assignment for Critical Resource

Incorrect permission assignment for critical resource vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier allows a remote unauthenticated attacker to access arbitrary files on the server and obtain...

Security Bulletin: IBM WebSphere Hybrid Edition is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44228)

Summary IBM Cloud Transformation Advisor, which is bundled with IBM WebSphere Hybrid Edition, is affected by Apache Log4j vulnerability CVE-2021-44228. Log4j is used by IBM Cloud Transformation Advisor for generating logs in some components and tools. This bulletin provides a remediation for the...

Security Bulletin: Vulnerability in Apache Log4j affects IBM Tivoli Network Manager IP Edition (CVE-2021-44228)

Summary A vulnerability was identified within the Apache Log4j library that is used by IBM Tivoli Network Manager IP Edition to provide logging functionality. This vulnerability has been addressed. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker...

Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS : OpenJDK vulnerabilities (USN-5202-1)

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5202-1 advisory. Varnavas Papaioannou discovered that the FTP client implementation in OpenJDK accepted alternate server IP addresses when...

CVE-2021-44023

A link following denial-of-service DoS vulnerability in the Trend Micro Security Consumer 2021 familiy of products could allow an attacker to abuse the PC Health Checkup feature of the product to create symlinks that would allow modification of files which could lead to a denial-of-service...

KLA12392 RCE vulnerability in Microsoft Azure

Remote code execution vulnerability was found in Microsoft Azure. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2021-44228 Exploitation Public exploits exist for this vulnerability. Malware exists for this vulnerability. Usually such malware is...

CVE-2021-41276

Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does not sanitize properly the search filter built from the ldapid attribute of a user during the daily synchronization. A malicious user could force accounts to ...

CVE-2021-43806 SQL injection in Tuleap

Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does not sanitize properly user settings when constructing the SQL query to browse and search commits in the CVS repositories. A authenticated malicious user with...

Security Bulletin: Vulnerability in Apache Log4j affects WebSphere Application Server which is bundled in IBM WebSphere Hybrid Edition (CVE-2021-44228)

Summary Vulnerability in Apache Log4j affects WebSphere Application Server which is bundled in IBM WebSphere Hybrid Edition CVE-2021-44228 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Principal Products and Versions...

Description of the security update for SharePoint Server Subscription Edition: December 14, 2021 (KB5002045)

None None...

PT-2021-6180 · Microsoft · Sharepoint Server +1

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Microsoft SharePoint Server Subscription Edition affected versions not specified Microsoft SharePoint Enterprise Server affected versions not specified Description: The issue is...

Cross site scripting

Collabora Online is a collaborative online office suite based on LibreOffice technology. In affected versions a reflected XSS vulnerability was found in Collabora Online. An attacker could inject unescaped HTML into a variable as they created the Collabora Online iframe, and execute scripts insid...