Huawei EulerOS: Security Advisory for java-1.8.0-openjdk (EulerOS-SA-2021-2587)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Malware Discovered in Popular NPM Package, ua-parser-js

Versions of a popular NPM package named ua-parser-js was found to contain malicious code. ua-parser-js is used in apps and websites to discover the type of device or browser a person is using from User-Agent data. A computer or device with the affected software installed or running could allow a...

DSR-500N Router Buffer Overflow

The vulnerability of the /etc/passwd component in the D-Link DSR-500N router’s microprogramming system is related to the use of pre-installed user accounts. Exploiting this vulnerability could allow a malicious actor to gain access to the device’s basic embedded Linux operating system...

Oracle Java SE and Oracle GraalVM Enterprise Edition Denial of Service Vulnerability (CNVD-2021-81803)

Java SE stands for Java Platform Standard Edition and is used to develop and deploy Java applications for desktops, servers, and embedded devices and real-time environments.Oracle GraalVM Enterprise Edition is an Oracle-based multilingual virtual machine for enterprise Java SE. A denial of servic...

Oracle Java SE and Oracle GraalVM Enterprise Edition Denial of Service Vulnerability (CNVD-2021-81805)

Java SE stands for Java Platform Standard Edition and is used to develop and deploy Java applications for desktops, servers, and embedded devices and real-time environments.Oracle GraalVM Enterprise Edition is an Oracle-based multilingual virtual machine for enterprise Java SE. A denial of servic...

CVE-2021-24415

The Polo Video Gallery – Best wordpress video gallery plugin WordPress plugin through 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the...

PT-2021-7846 · Qualcomm · Qualcomm

Name of the Vulnerable Software and Affected Versions: Linux Networking Firmware affected versions not specified Description: The issue is related to insufficient protection of service data during side channel analysis in the Linux Networking Firmware, specifically affecting Qualcomm embedded...

Zephyr integer underflow vulnerability

Zephyr is a small real-time operating system for interconnected, resource-constrained embedded devices. an integer underflow vulnerability in 6LoWPAN IPHC header decompression in Zephyr 2.4.0 and later can be exploited by attackers to cause out-of-bounds access in the Pv6 parsing logic...

Jira 8.19.X ships with JDK 11.0.11 which is affected by CVE-2021-2388

h3. Issue Summary Since the release of JRASERVER-72339 , Jira 8.19.X ships with OpenJDK 11 however the bundled AdoptOpen JDK 11.0.11 is affected by CVE-2021-2388 : https://nvd.nist.gov/vuln/detail/CVE-2021-2388 - CVSS 3.1 Base Score 7.5 Quote from doc bq. This vulnerability does not apply to Java...

Qualcomm Memory Use After Free

The vulnerability of microprogramming software in embedded Qualcomm chips is related to the use of memory after it is freed. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of protected information...

Dell BIOS Trust Management Issue Vulnerability

BIOS is an acronym that stands for Basic Input Output System. Also known as "system setup", BIOS is the embedded software inside a small memory chip on the motherboard of a computer. This chip is called a complementary metal oxide semiconductor CMOS. The Dell BIOS is vulnerable to trust managemen...

IBM Business Process Manager and IBM Business Automation Workflow have cross-site scripting vulnerabilities

IBM Business Process Manager BPM and IBM Business Automation Workflow are both products of IBM Corporation, U.S.A. IBM Business Process Manager is a comprehensive business process management platform. The platform provides a series of related tools for business process modeling, assembly,...

PT-2021-6167 · NetGear · Netgear Rbk352 +1

Name of the Vulnerable Software and Affected Versions: NETGEAR RBK352 versions prior to 4.4.0.10 NETGEAR RBR350 versions prior to 4.4.0.10 NETGEAR RBS350 versions prior to 4.4.0.10 Description: The issue is related to the lack of protection for service data in the embedded software of NETGEAR...

PT-2021-6209

Name of the Vulnerable Software and Affected Versions NETGEAR D6200 versions prior to 1.1.00.40 NETGEAR D7000 versions prior to 1.0.1.78 NETGEAR R6020 versions prior to 1.0.0.42 NETGEAR R6080 versions prior to 1.0.0.42 NETGEAR R6050 versions prior to 1.0.1.26 NETGEAR JR6150 versions prior to...

[SECURITY] Fedora 35 Update: mosquitto-2.0.12-1.fc35

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...

Amazon WorkSpaces Parameter Injection Vulnerability

Amazon WorkSpaces, a fully managed persistent desktop virtualization service from Amazon, lets your users access the data, applications, and resources they need from any supported device, anytime, anywhere. In Amazon AWS WorkSpaces clients prior to version 3.1.9 on Windows, parameter injection in...

CVE-2021-1615

A vulnerability in the packet processing functionality of Cisco Embedded Wireless Controller EWC Software for Catalyst Access Points APs could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected AP. This vulnerability is due to insufficient buffer...

CVE-2021-1611

A vulnerability in Ethernet over GRE EoGRE packet processing of Cisco IOS XE Wireless Controller Software for the Cisco Catalyst 9800 Family Wireless Controller, Embedded Wireless Controller, and Embedded Wireless on Catalyst 9000 Series Switches could allow an unauthenticated, remote attacker to...

Design/Logic Flaw

A vulnerability in the packet processing functionality of Cisco Embedded Wireless Controller EWC Software for Catalyst Access Points APs could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected AP. This vulnerability is due to insufficient buffer...

Gravity null pointer dereference vulnerability (CNVD-2021-89955)

Gravity is a powerful, dynamically typed, lightweight, embedded programming language written in C. A null pointer dereference vulnerability exists in the ircoderegisterpopcontextprotect function in gravityircode.c in Gravity 0.8.1 and earlier versions. An attacker could exploit this vulnerability...