[SECURITY] Fedora 32 Update: libmysofa-1.2-4.fc32

This is a simple set of C functions to read AES SOFA files, if they contain HRTFs stored according to the AES69-2015 standard...

Insecure Access Control

shinobi uses insecure access controls. An attacker is able to access the User/Admin/Super API functions through the use of JS Proto Method names held in an internal JS Object and trick the System into accepting supplied API Key that exists in the underlying JS object...

Design/Logic Flaw

An issue was discovered in Shinobi through ocean version 1. lib/auth.js has Incorrect Access Control. Valid API Keys are held in an internal JS Object. Therefore an attacker can use JS Proto Method names such as constructor or hasOwnProperty to convince the System that the supplied API Key exists...

CVE-2019-25024

OpenRepeater ORP before 2.2 allows unauthenticated command injection via shell metacharacters in the functions/ajaxsystem.php postservice parameter...

CVE-2019-25024: Improper Neutralization of Special Elements used in an OS Command

OpenRepeater ORP before 2.2 allows unauthenticated command injection via shell metacharacters in the functions/ajaxsystem.php postservice parameter...

PT-2021-9092

Name of the Vulnerable Software and Affected Versions OpenRepeater versions prior to 2.2 Description The issue allows unauthenticated command injection via shell metacharacters in the post service parameter of the "functions/ajax system.php" API endpoint. Recommendations For versions prior to 2.2...

CVE-2020-35339

In 74cms version 5.0.1, there is a remote code execution vulnerability in /Application/Admin/Controller/ConfigController.class.php and /ThinkPHP/Common/functions.php where attackers can obtain server permissions and control the server...

PT-2021-7658

Name of the Vulnerable Software and Affected Versions systeminformation versions prior to 5.3.1 Description The System Information Library for Node.JS is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1, the...

Integer overflow in CipherUpdate

Calls to EVPCipherUpdate, EVPEncryptUpdate and EVPDecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 indicating succes...

Authentication flaw

IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions, caused by improper session validation . By using the configuration panel to obtain a valid session using an attacker controlled IBM Spectrum Protect server, an attacker could...

CVE-2020-28500

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service ReDoS via the toNumber, trim and trimEnd functions...

Qlib Security Vulnerabilities

A security vulnerability exists in all versions of qlib that stems from the use of insecure YAML load functions for workflow functions...

PT-2021-12251

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Operations Center versions 7.1 through 8.1 Description The issue is caused by improper session validation, allowing a remote attacker to bypass authentication restrictions. An attacker could exploit this by using the...

CVE-2020-4954: Session Fixation

IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions, caused by improper session validation . By using the configuration panel to obtain a valid session using an attacker controlled IBM Spectrum Protect server, an attacker could...

PT-2021-3621

Name of the Vulnerable Software and Affected Versions python/cpython versions 0 through 3.6.13 python/cpython versions 3.7.0 through 3.7.10 python/cpython versions 3.8.0 through 3.8.8 python/cpython versions 3.9.0 through 3.9.2 Description The issue is related to Web Cache Poisoning via...

CVE-2020-4954

IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions, caused by improper session validation . By using the configuration panel to obtain a valid session using an attacker controlled IBM Spectrum Protect server, an attacker could...

CVE-2020-13185

Certain web application pages in the authenticated section of the Teradici Cloud Access Connector prior to v18 were accessible without the need to specify authentication tokens, which allowed an attacker in the ability to execute sensitive functions without credentials...

CVE-2020-13185

Certain web application pages in the authenticated section of the Teradici Cloud Access Connector prior to v18 were accessible without the need to specify authentication tokens, which allowed an attacker in the ability to execute sensitive functions without credentials...

CVE-2020-13185: Authentication Bypass Using an Alternate Path or Channel

Certain web application pages in the authenticated section of the Teradici Cloud Access Connector prior to v18 were accessible without the need to specify authentication tokens, which allowed an attacker in the ability to execute sensitive functions without credentials...

PT-2021-9565

Name of the Vulnerable Software and Affected Versions Teradici Cloud Access Connector versions prior to 18 Description The issue allows certain web application pages in the authenticated section to be accessed without specifying authentication tokens. This enables an attacker to execute sensitive...