5067 matches found
container-tools:3.0 security, bug fix, and enhancement update
An update is available for fuse-overlayfs, container-selinux, udica, runc, toolbox, podman, conmon, skopeo, crun, libslirp, oci-seccomp-bpf-hook, slirp4netns, containernetworking-plugins, buildah, criu, cockpit-podman. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS...
Important: kernel
Issue Overview: A NULL pointer dereference flaw may occur in the Linux kernel's relayopen in kernel/relay.c. if the allocpercpu function is not validated in time of failure and used as a valid address for access. An attacker could use this flaw to cause a denial of service. CVE-2019-19462 A new...
Ubuntu 16.04 ESM : Byobu vulnerability (USN-5234-1)
The remote Ubuntu 16.04 ESM host has a package installed that is affected by a vulnerability as referenced in the USN-5234-1 advisory. Sander Bos discovered that Byobu incorrectly handled certain Apport data. An attacker could possibly use this issue to expose sensitive information. Tenable has...
CVE-2021-25032
The CVE concerns the WordPress plugins PublishPress Capabilities and PublishPress Capabilities Pro (versions before 2.3.1). The issue stems from missing authorization and CSRF checks when updating plugin settings via the init hook, and failure to validate that updated options belong to the plugin...
CVE-2021-25032: Cross-Site Request Forgery (CSRF)
The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to be updated belong to the plugin. As a...
Mozilla Rust rusqlite crate memory corruption vulnerability
Mozilla Rust rusqlite crate is an ergonomic wrapper for using SQLite from Rust. it attempts to expose a rust-postgres-like interface. mozilla rust rusqlite crate versions 0.25.4 before 0.25.x and 0.26. 2 prior to 0.26.x versions have a security vulnerability that stems from a resource management...
Rust rusqlite crate资源管理错误漏洞
Rust rusqlite crate is an ergonomic wrapper for using SQLite from Rust. it attempts to expose a rust-postgres-like interface. versions 0.25.x prior to 0.25.4 and 0.26.x prior to 0.26.2 of Rust rusqlite crate are vulnerable to security vulnerability, which stems from a resource management error in...
CVE-2021-44684
naholyr github-todos 3.1.0 is vulnerable to command injection. The range argument for the hook subcommand is concatenated without any validation, and is directly used by the exec function...
PT-2021-24288
Name of the Vulnerable Software and Affected Versions: rusqlite crate versions 0.25.0 through 0.25.3 rusqlite crate versions 0.26.0 through 0.26.1 Description: The issue is related to several closure-accepting functions in the rusqlite crate, which have a too relaxed lifetime bound. This can allo...
PT-2021-24293
Name of the Vulnerable Software and Affected Versions: rusqlite versions 0.25.0 through 0.25.3 rusqlite versions 0.26.0 through 0.26.1 Description: The issue is related to a use-after-free problem in several closure-accepting functions, including Connection::create scalar function,...
Github-Todos 操作系统命令注入漏洞
Github-Todos is used to convert Todo to Github issues by the French individual developer Nicolas Chambrier. A security vulnerability exists in naholyr github-todos 3.1.0, which stems from the range parameter of the hook subcommand being concatenated without any validation and used directly by the...
PT-2021-24152
Name of the Vulnerable Software and Affected Versions: naholyr github-todos version 3.1.0 Description: The issue concerns a command injection vulnerability. Specifically, the range argument for the hook subcommand is concatenated without validation and directly used by the exec function. This lac...
VulnCheck KEV: CVE-2021-25032
The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to be updated belong to the plugin. As a...
CVE-2021-33488
chat in OX App Suite 7.10.5 has Improper Input Validation. A user can be redirected to a rogue OX Chat server via a development-related hook...
CVE-2021-33488
chat in OX App Suite 7.10.5 has Improper Input Validation. A user can be redirected to a rogue OX Chat server via a development-related hook...
CVE-2021-33488
chat in OX App Suite 7.10.5 has Improper Input Validation. A user can be redirected to a rogue OX Chat server via a development-related hook...
CVE-2021-33488
chat in OX App Suite 7.10.5 has Improper Input Validation. A user can be redirected to a rogue OX Chat server via a development-related hook...
CVE-2021-33488
chat in OX App Suite 7.10.5 has Improper Input Validation. A user can be redirected to a rogue OX Chat server via a development-related hook...
Authentication Bypass
spreeauthdevise is vulnerable to authentication bypass. An attacker can takeover an account through CSRF if protectfromforgery method satisfy both below: 1Executed whether as: A beforeaction callback the default A prependbeforeaction option prepend: true given before the :loadobject hook in...
Cross site request forgery (csrf)
solidusauthdevise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidusauthdevise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of solidusauthdevi...