EulerOS 2.0 SP3 : xdg-utils (EulerOS-SA-2021-1861)

According to the version of the xdg-utils package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The openenvvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER...

ISC BIND GSS-TSIG SPNEGO Buffer Overflow (CVE-2021-25216)

According to its self-reported version, the ISC Bind present on the remote host is affected by a buffer overflow vulnerability: - GSS-TSIG is an extension to the TSIG protocol which is intended to support the secure exchange of keys for use in verifying the authenticity of communications between...

Aruba ClearPass Policy Manager XML External Entity Injection Vulnerability

Aruba ClearPass Policy Manager is an application from Aruba, Inc. that provides a wireless network security access management system. An XML external entity injection vulnerability exists in Aruba ClearPass Policy Manager versions prior to 6.9.5, 6.8.9, and 6.7.14-HF1. The vulnerability stems fro...

Unauthorized Access Vulnerability in Riptide EWEB Management System

Ruijie Networks is a specialized network vendor with a full range of network equipment product lines and solutions, including switches, routers, software, security firewalls, wireless products, storage, and more. An unauthorized access vulnerability exists in the Ruijie EWEB management system,...

SUSE SLED15 / SLES15 Security Update : webkit2gtk3 (SUSE-SU-2021:1430-1)

This update for webkit2gtk3 fixes the following issues : Update to version 2.32.0 bsc1184155 : - Fix the authentication request port when URL omits the port. - Fix iframe scrolling when main frame is scrolled in async - scrolling mode. - Stop using gmemdup. - Show a warning message when overridin...

F5 Big-IP Vulnerable to Security-Bypass Bug

F5 Networks’ Big-IP Application Delivery Services appliance contains a Key Distribution Center KDC spoofing vulnerability, researchers disclosed – which an attacker could use to get past the security measures that protect sensitive workloads. Join Threatpost for “Fortifying Your Business Against...

Update of bind-sdb, bind-libs, bind-devel, bind, bind-utils, bind-chroot

...

SUSE SLES12 Security Update : curl (SUSE-SU-2021:1396-1)

This update for curl fixes the following issues : CVE-2021-22876: Fixed an issue where the automatic referer was leaking credentials bsc1183933. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

Command Execution Vulnerability in V8+ Terminal Security System (CNVD-2021-35828)

V8+ Terminal Security System is a new-generation enterprise terminal security software, which can dynamically detect, real-time process, and trace unknown threats in the user's network across the network to meet the increasingly complex needs of domestic enterprise users for security protection o...

Cisco Adaptive Security Appliance and Firepower Threat Defense Command Injection Vulnerability

Cisco Firepower Threat Defense FTD and Cisco Adaptive Security Appliance are both products of Cisco Corporation.Cisco Firepower Threat Defense is a suite of unified software that provides next-generation firewall services. Cisco Adaptive Security Appliance is a network appliance. Used to protect...

SUSE SLES12 Security Update : kernel (SUSE-SU-2021:1373-1)

This update for the Linux Kernel 4.4.180-94135 fixes one issue. The following security issues were fixed : CVE-2021-28688: Fixed an issue introduced by XSA-365 bsc1182294, bsc1183646. CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping XSA-365 bsc1182294. CVE-2021-26931:...

Logic Flaw Vulnerability in ENLINK CASB Backend Management System

Ltd. specializes in network security product development and sales, is the industry's leading "zero trust" solution provider. A logic flaw exists in the backend management system of ENLINK CASB, which can be exploited by an attacker to cause an arbitrary user password to log into the management...

nss: TLS 1.3 CCS flood remote DoS Attack

A flaw was found in the way NSS handled CCS ChangeCipherSpec messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability...

SUSE SLES12 Security Update : java-11-openjdk (SUSE-SU-2021:1314-1)

This update for java-11-openjdk fixes the following issues : Update to upstream tag jdk-11.0.11+9 April 2021 CPU - CVE-2021-2163: Fixed incomplete enforcement of JAR signing disabled algorithms bsc1185055 - CVE-2021-2161: Fixed incorrect handling of partially quoted arguments in ProcessBuilder...

Debian DLA-2637-1 : drupal7 security update

The Drupal project identified a vulnerability in the sanitization performed in the filterxssarttributes function, potentially allowing a cross-site scripting, and granted it the Drupal Security Advisory ID SA-CORE-2021-002 : https://www.drupal.org/sa-core-2021-002 No CVE number has been announced...

SUSE SLED15 / SLES15 Security Update : librsvg (SUSE-SU-2021:1310-1)

This update for librsvg fixes the following issues : librsvg was updated to 2.42.9 : - Update dependent crates that had security vulnerabilities: smallvec to 0.6.14 - RUSTSEC-2018-0003 - CVE-2018-20991 bsc1148293 -the bundled version of the cssparser crate now builds correctly on Rust 1.43...

Design/Logic Flaw

Inappropriate implementation in Network in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially access local UDP ports via a crafted HTML page...

CVE-2021-21210

Affected software: Google Chrome (before version 90.0.4430.72). The CVE describes an Inappropriate implementation in Network that could allow a remote attacker to potentially access local UDP ports via a crafted HTML page. Impact statements in the connected documents indicate a remote attacker co...

Trend Micro HouseCall for Home Networks elevation of privilege vulnerability (CNVD-2021-37058)

Trend Micro HouseCall for Home Networks is a suite of home network security scanning software from Trend Micro. The software supports scanning a wide range of home network devices and identifying network risks. An elevation of privilege vulnerability exists in Trend Micro HouseCall for Home...

systemd 安全漏洞

systemd is a Linux-based system and service manager from the individual developer Lennart Poettering in Germany. The product is compatible with SysV and LSB startup scripts and provides a framework for representing dependencies between system services. A security vulnerability exists in systemd d...