About the security content of macOS Monterey 12.1

About the security content of macOS Monterey 12.1 This document describes the security content of macOS Monterey 12.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or release...

About the security content of iOS 15.2 and iPadOS 15.2

About the security content of iOS 15.2 and iPadOS 15.2 This document describes the security content of iOS 15.2 and iPadOS 15.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches ...

Synel Eharmonynew 授权问题漏洞

Synel Eharmonynew is a time and attendance system from Synel Israel. Synel eharmonynew suffers from an authorization issue vulnerability that stems from the ability to log in to the system using default credentials and export eHarmony system reports containing sensitive data employee names,...

The Bug Report November 2021 Edition

The Bug Report — November 2021 Edition By Mark Bereza · November 30, 2021 Your Cybersecurity Comic Relief CVE-2021-20322: Of all the words of mice and men, the saddest are, “it was DNS again.” Why am I here? For all our newcomers, welcome to the Advanced Threat Research team’s monthly bug report ...

What Avengers Movies Can Teach Us About Cybersecurity

Marvel has been entertaining us for the last 20 years. We have seen gods, super-soldiers, magicians, and other irradiated heroes fight baddies at galactic scales. The eternal fight of good versus evil. A little bit like in cybersecurity, goods guys fighting cybercriminals. If we choose to go with...

PT-2021-8167 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a memory leak in the perf env insert btf function when a duplicate BTF id is encountered. This function does not insert the duplicate id and causes a memory lea...

PAN-OS: Memory Corruption Vulnerability in GlobalProtect Portal and Gateway Interfaces

A memory corruption vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to disrupt system processes and potentially execute arbitrary code with root privileges. The attacker must have network access to the...

Multiple BusyBox Security Bugs Threaten Embedded Linux Devices

Researchers have discovered 14 critical vulnerabilities in a popular program used in embedded Linux applications, all of which allow for denial of service DoS and 10 that also enable remote code execution RCE, they said. One of the flaws also could allow devices to leak info, according to...

PYSEC-2021-844

TensorFlow is an open source platform for machine learning. In affected versions the implementation of tf.math.segment operations results in a CHECK-fail related abort and denial of service if a segment id in segmentids is large. This is similar to CVE-2021-29584 and similar other reported...

PYSEC-2021-846

TensorFlow is an open source platform for machine learning. In affected versions the implementation of tf.math.segment operations results in a CHECK-fail related abort and denial of service if a segment id in segmentids is large. This is similar to CVE-2021-29584 and similar other reported...

PT-2021-23167 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.7.0 TensorFlow versions 2.6.1 and earlier TensorFlow versions 2.5.2 and earlier TensorFlow versions 2.4.4 and earlier Description: The implementation of tf.math.segment operations results in a CHECK-fail related...

NewStart CGSL CORE 5.04 / MAIN 5.04 : samba Vulnerability (NS-SA-2021-0114)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has samba packages installed that are affected by a vulnerability: - A flaw was found in samba. The Samba smbd file server must map Windows group identities SIDs into unix group ids gids. The code that performs this had a flaw...

About the security content of iOS 15.1 and iPadOS 15.1

About the security content of iOS 15.1 and iPadOS 15.1 This document describes the security content of iOS 15.1 and iPadOS 15.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches ...

About the security content of macOS Big Sur 11.6.1

About the security content of macOS Big Sur 11.6.1 This document describes the security content of macOS Big Sur 11.6..1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...

Security Bulletin: Vulnerability in WebSphere Commerce related to persistent sessions and personalization IDs. (CVE-2012-3300)

Question Security Bulletin: Vulnerability in WebSphere Commerce related to persistent sessions and personalization IDs. CVE-2012-3300 | -9F7F4EC1049C904F85257A77006D19A9- | Answer Flash Alert Abstract WebSphere Commerce contains a security vulnerability related to its use of persistent sessions a...

CVE-2021-38458

creationtimestamp| type| source ---|---|--- 2021-10-12 18:25:54+00:00| seen| https://t.me/cibsecurity/30425 2022-02-13 13:50:12+00:00| seen| https://t.me/NeKaspersky/1799 2022-02-14 17:40:00+00:00| seen| https://t.me/truesecator/2627...

CVE-2021-41797

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: non...

CVE-2021-40884

Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-edit.php and id parameter in process.php function, a user with uploader role can download and edit all files of users in application...

CVE-2021-40888

Projectsend version r1295 is affected by Cross Site Scripting XSS due to lack of sanitization when echo output data in returnFilesIds function. A low privilege user can call this function through process.php file and execute scripting code...

CVE-2021-40884

CVE-2021-40884 affects ProjectSend version r1295. The root cause is missing authorization checks for the ids parameter in files-edit.php and the id parameter in process.php, enabling a user with uploader role to download and edit all users’ files. The vulnerability is described across multiple so...