5454 matches found
CVE-2021-25901
An issue was discovered in the lazy-init crate through 2021-01-17 for Rust. Lazy lacks a Send bound, leading to a data race...
FreeBSD : cloud-init -- Wrong access permissions of authorized keys (8899298f-5a92-11eb-8558-3085a9a47796)
cloud-init reports : cloud-init release 20.4.1 is now available. This is a hotfix release, that contains a single patch to address a security issue in cloud-init 20.4. Briefly, for users who provide more than one unique SSH key to cloud-init and have a shared AuthorizedKeysFile configured in...
addr2line (0.6.0), backtrace (>=0.3.6, <=0.3.9) +11 more potentially affected by CVE-2021-25901 via lazy-init (>=0.1.1, <=0.3.0)
lazy-init CARGO version =0.1.1, =0.3.6, =0.1.0, =0.1.0, =0.1.0, =0.7.0, =0.4.0, =0.4.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.3.0 Source cves: CVE-2021-25901 Source advisory: OSV:RUSTSEC-2021-0004...
Quest Policy Authority For Unified Communications Cross-Site Scripting Vulnerability
Quest Policy Authority For Unified Communications is a software from Quest, Inc. that is used in corporate environments to consolidate communication data between various media text and instant messaging, video conferencing, email and voicemail. A cross-site scripting vulnerability exists in Quest...
cloud-init -- Wrong access permissions of authorized keys
cloud-init reports: cloud-init release 20.4.1 is now available. This is a hotfix release, that contains a single patch to address a security issue in cloud-init 20.4. Briefly, for users who provide more than one unique SSH key to cloud-init and have a shared AuthorizedKeysFile configured in...
OSV-2018-226 Heap-buffer-overflow in pcf_get_encodings
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9561 Crash type: Heap-buffer-overflow READ 1 Crash state: pcfgetencodings pcfloadfont PCFFaceInit...
Quest Software Policy Authority For Unified Communications 跨站脚本漏洞
Quest Policy Authority For Unified Communications is a software from Quest, Inc. that is used in corporate environments to consolidate communication data between various media text and instant messaging, video conferencing, email and voicemail. A cross-site scripting vulnerability exists in Quest...
Medium: cloud-init
Issue Overview: The default cloud-init configuration included "sshdeletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one...
Amazon Linux 2 : cloud-init (ALAS-2021-1576)
The version of cloud-init installed on the remote host is prior to 19.3-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1576 advisory. The default cloud-init configuration included sshdeletekeys: 0, disabling cloud-init's deletion of ssh host keys. In som...
ListingPro < 2.6.1 - Unauthenticated Sensitive Data Disclosure (Usernames, Emails etc)
Unauthenticated users could gain access to sensitive data, such as usernames, full names, email addresses and in some case phone numbers by sending a request to /wp-admin/index.php?download-lp-users=yes which is registered to the init hook...
A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO operations. A guest user may abuse this flaw to crash the QEMU process on the host resulting in a denial of service. This flaw affects QEMU versions prior to 5.2.0.
...
CVE-2020-26957
OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. This could result in a failure to enforce some certificate revocations. Note: This issue only affected Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox...
NewStart CGSL CORE 5.04 / MAIN 5.04 : poppler Multiple Vulnerabilities (NS-SA-2020-0074)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has poppler packages installed that are affected by multiple vulnerabilities: - An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc...
NewStart CGSL CORE 5.05 / MAIN 5.05 : poppler Multiple Vulnerabilities (NS-SA-2020-0110)
The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has poppler packages installed that are affected by multiple vulnerabilities: - An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc...
SUSE SLED15 / SLES15 Security Update : ceph (SUSE-SU-2020:3473-1)
This update for ceph fixes the following issues : CVE-2020-25660: Bring back CEPHXV2 authorizer challenges bsc1177843. Added --container-init feature bsc1177319, bsc1163764 Made journald as the logdriver again bsc1177933 Fixes a condition check for copytree, copyfiles, and movefiles in cephadm...
OSV-2020-2217 Heap-buffer-overflow in std::__1::pair<int, void*> uWS::HttpParser::fenceAndConsumePostPadded<0>
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28143 Crash type: Heap-buffer-overflow READ Crash state: std::1::pair uWS::HttpParser::fenceAndConsumePostPadded uWS::HttpParser::consumePostPadded uWS::HttpContext::init...
The vulnerability in the loaded module drivers/net/ethernet/broadcom/bnx2.ko of the Linux operating system allows a hacker to cause a service failure.
The vulnerability of the loaded module drivers/net/ethernet/broadcom/bnx2.ko in the Linux operating system is related to a memory leak in the implementation of the bnx2initone handler. Exploiting this vulnerability can allow an attacker to cause a service failure by connecting a QLogic bnx2 netwo...
PT-2020-7005 · Linux +2 · Linux Kernel +2
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a reference leak in the Linux kernel's i2c component, specifically in the img-scb driver. The problem occurs when the pm runtime get sync function fails, causin...
