openSUSE 15 Security Update : nodejs12 (openSUSE-SU-2021:1059-1)

"The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1059-1 advisory. - This affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix: const y18n = require'y18n' %NASLMINLEVEL 70300 C Tenable...

PT-2021-21364 · Victron Energy · Victron Energy Venus Os

Name of the Vulnerable Software and Affected Versions: Victron Energy Venus OS versions through 2.72 Description: The issue allows root access by default to anyone with physical access to the device, which may be considered a violation of security best practices. However, the vendor disagrees wit...

CVE-2021-20499

Affected product: IBM Security Verify Access Docker 10.0.0. Vulnerability type / impact: remote information disclosure where detailed technical error messages returned in the browser expose sensitive information. This could be leveraged in further attacks against the system. Root cause (as descri...

CVE-2021-33783

Windows SMB Information Disclosure Vulnerability...

CVE-2021-34507

Technical details, affected products, vulnerable components, and remediation are not provided in the connected documents. Monitor for updates from official sources to obtain concrete technical information about CVE-2021-34507.

CVE-2021-0604

In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible way to share private files over Bluetooth due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product:...

CVE-2021-0597

In notifyProfileAdded and notifyProfileRemoved of SipService.java, there is a possible way to retrieve SIP account names due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

CVE-2021-33678

CVE-2021-33678 affects SAP NetWeaver AS ABAP (Reconciliation Framework) across multiple releases (700–75F). A high-privilege attacker can inject code executed by the application, potentially deleting data and causing DoS/unavailability. Affected component: Reconciliation Framework function module...

PT-2021-7654

Name of the Vulnerable Software and Affected Versions SonicWall Secure Remote Access SRA appliances versions 8.x through 9.0.0.9-26sv Description The issue is related to improper neutralization of a SQL command, leading to a SQL injection vulnerability. This vulnerability impacts end-of-life Secu...

Node.js 12.x < 12.22.2, 14.x < 14.17.0 Multiple Vulnerabilities - Windows

Node.js is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nodejs:node.js"; ifdescription...

PT-2021-5691 · Microsoft · Office Online Server

Name of the Vulnerable Software and Affected Versions: Microsoft Office Online Server affected versions not specified Description: The issue is related to errors in the representation of information by the user interface of the Office Online Server. It may allow a remote attacker to conduct...

PT-2021-4850 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to an information disclosure vulnerability in the Remote Access Connection Manager service of the Microsoft Windows operating system. This vulnerability can be exploite...

CVE-2021-22918

CVE-2021-22918 affects Node.js releases prior to 16.4.1, 14.17.2 and 12.22.2 due to an out-of-bounds read in libuv’s uv__idna_toascii() used during DNS lookups. The flaw allows information disclosure or crashes when a crafted domain is processed via uv_getaddrinfo(). The root cause is reading bey...

PT-2024-11310 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel version 5.13.0+ Description: The issue arises from the skb tunnel info function returning a pointer of lwtstate-data as ip tunnel info type without validation. lwtstate-data can have various types, such as mpls iptunnel encap,...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in XStream

Summary Multiple vulnerabilities in XStream that is used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID: CVE-2021-21342 DESCRIPTION: XStream is vulnerable to server-side request forgery, caused by a flaw when processing stream at unmarshalling time. By manipulati...

CVE-2020-20584

A cross site scripting vulnerability in baigo CMS v4.0-beta-1 allows attackers to execute arbitrary web scripts or HTML via the form parameter post to /public/console/profile/info-submit/...

CVE-2020-20586

A cross site request forgery CSRF vulnerability in the /xyhai.php?s=/Auth/editUser URI of XYHCMS V3.6 allows attackers to edit any information of the administrator such as the name, e-mail, and password...

CVE-2021-21779

A use-after-free vulnerability exists in the way Webkit’s GraphicsContext handles certain events in WebKitGTK 2.30.4. A specially crafted web page can lead to a potential information leak and further memory corruption. A victim must be tricked into visiting a malicious web page to trigger this...

PT-2021-10508

Name of the Vulnerable Software and Affected Versions: baigo CMS version 4.0-beta-1 Description: A cross-site scripting issue allows attackers to execute arbitrary web scripts or HTML via the post parameter to the "/public/console/profile/info-submit/" API endpoint. Recommendations: For baigo CMS...

[ASA-202107-13] nodejs: multiple issues

Arch Linux Security Advisory ASA-202107-13 ========================================== Severity: High Date : 2021-07-06 CVE-ID : CVE-2021-22918 CVE-2021-23362 CVE-2021-27290 Package : nodejs Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2126 Summary ======= The...