OESA-2021-1168 nodejs-hosted-git-info security update

Provides metadata and conversions from repository urls for Github, Bitbucket and Gitlab Security Fixes: The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service ReDoS via regular expression shortcutMatch in the fromUrl function in index.js. The affected...

CVE-2020-4883

IBM QRadar SIEM 7.3 and 7.4 could disclose sensitive information about other domains which could be used in further attacks against the system. IBM X-Force ID: 190907...

CVE-2021-29247

BTCPay Server

[SECURITY] Fedora 33 Update: pngcheck-2.4.0-8.fc33

pngcheck verifies the integrity of PNG, JNG and MNG files by checking the internal 32-bit CRCs checksums and decompressing the image data; it can optionally dump almost all of the chunk-level information in the image in human-readable form. For example, it can be used to print the basic statist i...

CVE-2021-21537

Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability. A local unauthenticated attacker may exploit this vulnerability in order to view and exfiltrate sensitive information on the system...

Information disclosure

Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability. A local unauthenticated attacker may exploit this vulnerability in order to gain access to sensitive information via the local API...

Information disclosure

Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability. A local unauthenticated attacker may exploit this vulnerability in order to view and exfiltrate sensitive information on the system...

CVE-2021-21534

Dell Hybrid Client, versions prior to 1.5, contains an information exposure vulnerability via the local API that could allow a local unauthenticated attacker to access sensitive information. Affected software, root cause and impact are documented across multiple sources (NVD, CVE record, and regi...

CVE-2021-1085

NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager vGPU plugin, where there is the potential to write to a shared memory location and manipulate the data after the data has been validated, which may lead to denial of service and escalation of privileges and information...

CVE-2021-30233

The api/ZRIptv/setIptvInfo interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the iptvvlan parameter...

Design/Logic Flaw

A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the nolog feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. The highest threat from this vulnerability...

PT-2021-19559 · Cesanta · Mongooseos Mjs

Name of the Vulnerable Software and Affected Versions: Cesanta MongooseOS mJS version 1.26 Description: A maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs json parse, potentially leading to redirection of control flow. The original reporter disputes the...

Security Bulletin: XStream XML information discloure vulnerability affects IBM® Rational® Quality Manager (CVE-2016-3674)

Summary XStream XML information discloure in XStream libraries shipped with IBM Rational Quality Manager could allow a remote attacker to obtain sensitive information. Vulnerability Details CVEID: CVE-2016-3674 DESCRIPTION: XStream libraries shipped with IBM Rational Quality Manager could allow a...

PT-2021-18641 · Unknown · Network Camera Device

Name of the Vulnerable Software and Affected Versions: Network camera device affected versions not specified Description: The issue concerns the manage users profile services of the network camera device, which allows an authenticated remote attacker to modify URL parameters and amend a user's...

Security Bulletin: An Info-ZIP Unzip vulnerability has been identified in IBM Tivoli Application Dependency Discovery Manager(TADDM).

Summary This security bulletin addresses the vulnerability in Info-ZIP's Unzip used by IBM Tivoli Application Dependency Discovery ManagerTADDM. Vulnerability Details CVEID: CVE-2018-18384 DESCRIPTION: Info-ZIP UnZip is vulnerable to a buffer overflow, caused by improper bounds checking by the...

Design/Logic Flaw

IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information by allowing cross-window communication with unrestricted target origin via documentation frames...

CVE-2021-28168

Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are...

Backdoor Found in Codecov Bash Uploader

Developers have discovered a backdoor in the Codecov bash uploader. Its been there for four months. We dont know who put it there. Codecov said the breach allowed the attackers to export information stored in its users continuous integration CI environments. This information was then sent to a...

The vulnerability in the BPF subsystem of the `map_create` or `check_btf_info` function of the Linux kernel allows a malicious actor to cause an unexpected termination of the application.

The vulnerability of the BPF subsystem of the mapcreate function kernel/bpf/syscall.c or checkbtfinfo function kernel/bpf/verifier.c in the Linux operating system kernel is due to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker to cause an applicati...

Huawei Data Communication: The log server should be configured for info-center loghost

Configure the log host. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify...