PT-2021-26011

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.249 Description A lock order reversal issue was fixed in the md alloc function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

PT-2021-30131

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.70 Description A lock order reversal issue was fixed in the md alloc function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v5.10.70...

md-health.com Cross Site Scripting vulnerability OBB-2166063

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Remote Code Execution (RCE)

Overview md-to-pdf is a CLI tool for converting Markdown files to PDF. Affected versions of this package are vulnerable to Remote Code Execution RCE due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine. PoC: bash //Before running poc.js: $ cat...

CVE-2021-35522

A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2, Sigma devices before 4.9.4, and MA VP MD devices before 4.9.7 allows remote attackers to achieve code execution, denial of services, and information disclosure via TCP/IP packets...

Buffer overflow

A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2, Sigma devices before 4.9.4, and MA VP MD devices before 4.9.7 allows remote attackers to achieve code execution, denial of services, and information disclosure via TCP/IP packets...

CVE-2021-35522

A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2, Sigma devices before 4.9.4, and MA VP MD devices before 4.9.7 allows remote attackers to achieve code execution, denial of services, and information disclosure via TCP/IP packets...

CVE-2021-35522

A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2, Sigma devices before 4.9.4, and MA VP MD devices before 4.9.7 allows remote attackers to achieve code execution, denial of services, and information disclosure via TCP/IP packets...

CVE-2021-35522: Out-of-bounds Write

A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2, Sigma devices before 4.9.4, and MA VP MD devices before 4.9.7 allows remote attackers to achieve code execution, denial of services, and information disclosure via TCP/IP packets...

OracleVM 3.4 : kernel-uek (OVMSA-2021-0022)

The remote OracleVM system is missing necessary patches to address security updates: - Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adjacent access. CVE-2020-12352 - An issue was discovered in the Linux kernel before 5.8.1...

PT-2021-15917

Name of the Vulnerable Software and Affected Versions JoomSport WordPress plugin versions prior to 5.1.8 Description The issue arises from the joomsport md load AJAX action in the JoomSport WordPress plugin, which unserializes user input from the shattr POST parameter. This leads to a PHP Object...

Unbreakable Enterprise kernel security update

5.4.17-2102.202.5 - sctp: delay autoasconf init until binding the first addr Xin Long Orabug: 32907967 CVE-2021-23133 CVE-2021-23133 - dm ioctl: fix out of bounds array access when no devices Mikulas Patocka Orabug: 32860491 CVE-2021-31916 - uek-rpm: update kABI lists for the new symbols Saeed...

Unbreakable Enterprise kernel-container security update

4.14.35-2047.504.2.el7 - md/raid1: properly indicate failure when ending a failed write request Paul Clements Orabug: 32887159 - video: hypervfb: Add ratelimit on error message Michael Kelley Orabug: 32856879 - Drivers: hv: vmbus: Initialize unloadevent statically Andrea Parri Microsoft Orabug:...

Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2021-9305)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9305 advisory. - dm ioctl: fix out of bounds array access when no devices Mikulas Patocka Orabug: 32860493 CVE-2021-31916 - powerpc/64s: flush L1D after user accesses...

kernel security and bug fix update

3.10.0-1160.31.1.OL7 - Update Oracle Linux certificates Ilya Okomin - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x64 vmmm after calling handleuserfault Phili...

GSD-2021-1000141 md/raid1: properly indicate failure when ending a failed write request

md/raid1: properly indicate failure when ending a failed write request This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.36 by commit...

UVI-2021-1000173 md/raid1: properly indicate failure when ending a failed write request

md/raid1: properly indicate failure when ending a failed write request This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.118 by commit...

GSD-2021-1000106 md/raid1: properly indicate failure when ending a failed write request

md/raid1: properly indicate failure when ending a failed write request This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.11.20 by commit...

GSD-2021-1000173 md/raid1: properly indicate failure when ending a failed write request

md/raid1: properly indicate failure when ending a failed write request This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.118 by commit...

UVI-2021-1000141 md/raid1: properly indicate failure when ending a failed write request

md/raid1: properly indicate failure when ending a failed write request This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.36 by commit...