FreeBSD : Solr -- Apache Log4J (66cf7c43-5be3-11ec-a587-001b217b3468)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 66cf7c43-5be3-11ec-a587-001b217b3468 advisory. - Solr reports: Apache Solr affected by Apache Log4J 66cf7c43-5be3-11ec-a587-001b217b3468 Note that...

FreeBSD : Grafana -- Path Traversal (e33880ed-5802-11ec-8398-6c3be5272acd)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e33880ed-5802-11ec-8398-6c3be5272acd advisory. - Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1...

FreeBSD : graylog -- include log4j patches (3fadd7e4-f8fb-45a0-a218-8fd6423c338f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 3fadd7e4-f8fb-45a0-a218-8fd6423c338f advisory. - Apache Log4j2 2.10 this behavior can be mitigated by setting system property log4j2.formatMsgNoLookup...

FreeBSD : Grafana -- Incorrect Access Control (99bff2bd-4852-11ec-a828-6c3be5272acd)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 99bff2bd-4852-11ec-a828-6c3be5272acd advisory. - Grafana is an open-source platform for monitoring and observability. In affected versions when the...

FreeBSD : chromium -- multiple vulnerabilities (18ac074c-579f-11ec-aac7-3065ec8fd3ec)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 18ac074c-579f-11ec-aac7-3065ec8fd3ec advisory. - Use after free in window manager in Google Chrome on ChromeOS prior to 96.0.4664.93 allowed ...

FreeBSD : Gitlab -- Multiple Vulnerabilities (b299417a-5725-11ec-a587-001b217b3468)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the b299417a-5725-11ec-a587-001b217b3468 advisory. - Improper access control in the GitLab CE/EE API affecting all versions starting from 9.4...

FreeBSD : OpenSearch -- Log4Shell (4b1ac5a3-5bd4-11ec-8602-589cfc007716)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4b1ac5a3-5bd4-11ec-8602-589cfc007716 advisory. - Apache Log4j2 2.10 this behavior can be mitigated by setting system property log4j2.formatMsgNoLookup...

FreeBSD : Matrix clients -- several vulnerabilities (0dcf68fa-5c31-11ec-875e-901b0e9408dc)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0dcf68fa-5c31-11ec-875e-901b0e9408dc advisory. - Matrix developers report: Today we are releasing security updates to libolm, matrix-js-sdk, and sever...

FreeBSD : go -- multiple vulnerabilities (720505fe-593f-11ec-9ba8-002324b2fba8)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 720505fe-593f-11ec-9ba8-002324b2fba8 advisory. - net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumptio...

bastillion -- log4j vulnerability

FreeBSD port maintainer reports: Bastillion uses log4j...

OPNsense Cross-Site Scripting Vulnerability

OPNsense is an open source, FreeBSD-based firewall and routing software developed by Deciso Inc. A cross-site scripting vulnerability exists in versions prior to OPNsense 21.7.4. An attacker can exploit the vulnerability by returning LDAP attributes in the authentication tester to conduct...

FreeBSD : jenkins -- multiple vulnerabilities (2bf56269-90f8-4a82-b82f-c0e289f2a0dc)

Jenkins Security Advisory : DescriptionCritical SECURITY-2455 / CVE-2021-21685, CVE-2021-21686, CVE-2021-21687, CVE-2021-21688, CVE-2021-21689, CVE-2021-21690, CVE-2021-21691, CVE-2021-21692, CVE-2021-21693, CVE-2021-21694, CVE-2021-21695 Multiple vulnerabilities allow bypassing path filtering of...

Apache Traffic Server (ATS) 8.0.0 < 8.1.3, 9.0.0 < 9.1.1 Multiple Vulnerabilities

Apache Traffic Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:trafficserver"...

FreeBSD : gitea -- multiple vulnerabilities (df794e5d-3975-11ec-84e8-0800273f11ea)

The Gitea Team reports for release 1.15.5 : - Upgrade Bluemonday to v1.0.16 17372 17374 - Ensure correct SSH permissions check for private and restricted users 17370 17373 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted fr...

CVE-2021-41585 ATS stops accepting connections on FreeBSD

Improper Input Validation vulnerability in accepting socket connections in Apache Traffic Server allows an attacker to make the server stop accepting new connections. This issue affects Apache Traffic Server 5.0.0 to 9.1.0...

FreeBSD : chromium -- multiple vulnerabilities (976d7bf9-38ea-11ec-b3b0-3065ec8fd3ec)

Chrome Releases reports : This release contains 8 security fixes, including : - 1259864 High CVE-2021-37997 : Use after free in Sign-In. Reported by Wei Yuan of MoyunSec VLab on 2021-10-14 - 1259587 High CVE-2021-37998 : Use after free in Garbage Collection. Reported by Cassidy Kim of Amber...

FreeBSD : fail2ban -- possible RCE vulnerability in mailing action using mailutils (c848059a-318b-11ec-aa15-0800270512f4)

Jakub Zoczek reports : Command mail from mailutils package used in mail actions like mail-whois can execute command if unescaped sequences \n are available in 'foreign' input for instance in whois output. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks...

FreeBSD : Grafana -- Snapshot authentication bypass (757ee63b-269a-11ec-a616-6c3be5272acd)

Grafana Labs reports : Unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths : - /dashboard/snapshot/:key, or - /api/snapshots/:key If the snapshot 'publicmode' configuration setting is set to true vs default of false,...

FreeBSD : minio -- policy restriction issue (f4b15f7d-d33a-4cd0-a97b-709d6af0e43e)

minio developers report : Looks like policy restriction was not working properly for normal users when they are not svc or STS accounts. - svc accounts are now properly fixed to get right permissions when its inherited, so we do not have to set 'owner = true' - sts accounts have always been using...

FreeBSD : chromium -- multiple vulnerabilities (bdaecfad-3117-11ec-b3b0-3065ec8fd3ec)

Chrome Releases reports : This release contains 19 security fixes, including : - 1246631 High CVE-2021-37981: Heap buffer overflow in Skia. Reported by Yangkang @dnpushme of 360 ATA on 2021-09-04 - 1248661 High CVE-2021-37982: Use after free in Incognito. Reported by Weipeng Jiang @Krace from...