libblockdev bug fix and enhancement update

The libblockdev packages provide a C library with GObject introspection support used for low-level operations on block devices. The library serves as a thin wrapper around plug-ins for specific functionality, such as LVM, Btrfs, LUKS, or MD RAID. Bug Fixes and Enhancements: libblockdev doesn't ru...

CVE-2021-26752

NeDi 1.9C allows an authenticated user to execute operating system commands in the Nodes Traffic function on the endpoint /Nodes-Traffic.php via the md or ag HTTP GET parameter. This allows an attacker to obtain access to the operating system where NeDi is installed and to all application data...

CVE-2021-26752: Improper Neutralization of Special Elements used in an OS Command

NeDi 1.9C allows an authenticated user to execute operating system commands in the Nodes Traffic function on the endpoint /Nodes-Traffic.php via the md or ag HTTP GET parameter. This allows an attacker to obtain access to the operating system where NeDi is installed and to all application data...

PT-2021-17123

Name of the Vulnerable Software and Affected Versions NeDi version 1.9C Description The issue allows an authenticated user to execute operating system commands in the Nodes Traffic function on the endpoint "/Nodes-Traffic.php" via the md or ag HTTP GET parameter. This enables an attacker to obtai...

kernel security, bug fix, and enhancement update

3.10.0-1160.15.2.OL7 - Oracle Linux certificates Ilya Okomin - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x64 = 15-2.0.3 3.10.0-1160.15.2 - fs nfs: Fix...

PT-2021-1981

Name of the Vulnerable Software and Affected Versions Libgcrypt version 1.9.0 Description The issue is related to a heap-based buffer overflow in the gcry md block write function in the Libgcrypt library. This occurs when the digest final function sets a large count value. The estimated number of...

kernel security and bug fix update

3.10.0-1160.11.1.OL7 - Oracle Linux certificates Ilya Okomin - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x64 slotsret under spinlockirq protection Rafael...

md-fashion.com.ua Cross Site Scripting vulnerability OBB-1394838

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

md-fashion.com.ua Cross Site Scripting vulnerability OBB-1375389

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

PT-2020-16310

Name of the Vulnerable Software and Affected Versions md4c version 0.4.5 Description The issue allows attackers to trigger the use of uninitialized memory and cause a denial of service, such as an assertion failure, via a malformed Markdown document. This is due to a problem in the md push block...

Librepo Directory Traversal Vulnerability

Librepo is a library that provides C and Python APIs for downloading packages in rpm-md format and linux repository metadata. A directory traversal vulnerability exists in the Librepo product. The vulnerability stems from a failure of a networked system or product to properly filter special...

koa2-swagger-ui (2.2.1), md-docs-express (>=0.0.1, <=0.0.2) potentially affected by unknown CVE via swagger-ui (>=3.0.5, <=3.0.7)

swagger-ui NPM version =3.0.5, =0.0.1, =0.0.2 Source cves: unknown CVE Source advisory: OSV:GHSA-388G-JWPG-X6J4...

api-browser (>=0.0.1, <=0.0.3), decoupled-swagger-editor (1.0.0) +3 more potentially affected by unknown CVE via swagger-ui (>=3.0.5, <=3.20.7)

swagger-ui NPM version =3.0.5, =0.0.1, =0.0.1, =3.0.12, =3.1.8 Source cves: unknown CVE Source advisory: OSV:GHSA-4F9M-PXWH-68HG...

Unbreakable Enterprise kernel security update

4.14.35-2025.400.9 - btrfs: merge btrfsfinddevice and finddevice Anand Jain Orabug: 31867382 CVE-2019-18885 - sctp: implement memory accounting on tx path Xin Long Orabug: 31867387 CVE-2019-3874 - Revert 'zram: convert remaining CLASSATTR to CLASSATTRRO' Wade Mealing Orabug: 31867403 CVE-2020-107...

Cross-Site Scripting in ngx-md

Versions of ngx-md prior to 6.0.3 are vulnerable to Cross-Site Scripting. Links are not properly restricted to http/https and can contain JavaScript which may lead to arbitrary code execution. Markdown input such as Click Me is rendered as a Click Me link that executes JavaScript. Recommendation...

GHSA-XR53-M937-JR9C Cross-Site Scripting in ngx-md

Versions of ngx-md prior to 6.0.3 are vulnerable to Cross-Site Scripting. Links are not properly restricted to http/https and can contain JavaScript which may lead to arbitrary code execution. Markdown input such as Click Me is rendered as a Click Me link that executes JavaScript. Recommendation...

Cross-site Scripting (XSS)

md-data-table is vulnerable to cross-site scripting XSS. The vulnerability exists through the lack of sanitization of the value of mdt-row...

PT-2020-21595

Name of the Vulnerable Software and Affected Versions ngx-md versions prior to 6.0.3 Description The issue allows for Cross-Site Scripting due to improper restriction of links to http/https, which can contain JavaScript and lead to arbitrary code execution. For example, Markdown input such as Cli...

Cross-Site Scripting in md-data-table

All versions of md-data-table are vulnerable to cross-site scripting XSS. This vulnerability is exploitable if an attacker has control over data that is rendered by mdt-row Recommendation As there is no fix for this vulnerability at this time we recommend either selecting another package to perfo...

sign_project (1.0.0) potentially affected by unknown CVE via md-data-table (2.2.0)

md-data-table NPM version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on md-data-table and may be impacted: - signproject 1.0.0 Source cves: unknown CVE Source advisory: OSV:GHSA-HGR5-82RC-P936...