CVE-2021-28963: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled parameters...

Shibboleth 注入漏洞

Shibboleth is an open source SAML protocol web single sign-on system for Windows based platforms from Shibboleth, UK. A security vulnerability exists in Shibboleth Service Provider before 3.2.1, which stems from template generation using attacker-controlled parameters...

SUSE-SU-2021:0914-1 Security Beta update for Salt

This update fixes the following issues: salt: - virt.networkupdate: handle missing ipv4 netmask attribute - Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules bsc1177474 - Fix race conditions for corner cases when handling SIGTERM by minion bsc1172110 - Allow extrafilerefs ...

ALPINE-CVE-2021-27928

A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database...

UBUNTU-CVE-2021-27928

A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database...

Unspecified Vulnerability in IBM API Connect

IBM API Connect APIConnect is a suite of integrated solutions for managing the API lifecycle from IBM USA. The product supports creating, running, managing, and securing APIs, microservices, and more. IBM API Connect suffers from a security vulnerability that allows an attacker to be able to use ...

[SECURITY] [DSA 4872-1] shibboleth-sp security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4872-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff March 18, 2021 https://www.debian.org/security/faq -...

PT-2021-18003

Name of the Vulnerable Software and Affected Versions: Shibboleth Service Provider versions prior to 3.2.1 Description: The issue allows content injection due to template generation using attacker-controlled parameters. This enables potential attackers to inject malicious content. Recommendations...

Unsupported license deployment alarm in Veeam Service Provider Console

Challenge Veeam Service Provider Console displays the alarm: Unsupported license deployment. Shared license key Copy The Alarm Description states: The same license ID has been detected for the backups servers: Copy Cause This alarm occurs when the same license is detected as having been installed...

Managed Veeam Backup Agents are offline after Veeam Service Provider Console upgrade

Challenge After upgrading Veeam Service Provider Console, all Veeam Management Agents are listed as offline. Cause This may be caused by an incorrect security certificate configuration, which leads to the disconnection of the management agent on the Veeam Cloud Connect server after the upgrade. S...

Veeam Service Provider Console v5 Patch 2

This patch has been superseded by Veeam Service Provider Console v5 Patch 3. Requirements Please confirm you are running version5.0.0.6726 or later before installing Patch 2. You can check this by logging in to the backup portal and navigating to the Configuration Support Information tab. After...

CVE-2021-20440

IBM API Connect 10.0.0.0, and 2018.4.1.0 through 2018.4.1.13 does not restrict member registration to the intended recepient. An attacker who is a valid user in the user registry used by API Manager can use a stolen invitation link and register themselves as a member of an API provider...

IBM API Connect 安全漏洞

IBM API Connect APIConnect is a suite of integrated solutions for managing the API lifecycle from IBM USA. The product supports creating, running, managing, and securing APIs, microservices, and more. IBM API Connect suffers from a security vulnerability that allows an attacker to be able to use ...

CVE-2021-26864

Windows Virtual Registry Provider Elevation of Privilege Vulnerability...

Privilege escalation

Windows Virtual Registry Provider Elevation of Privilege Vulnerability...

CVE-2021-26864

Windows Virtual Registry Provider Elevation of Privilege Vulnerability...

CVE-2021-26864 Windows Virtual Registry Provider Elevation of Privilege Vulnerability

...

CVE-2021-21378 JWT authentication bypass with unknown issuer token

Envoy is a cloud-native high-performance edge/middle/service proxy. In Envoy version 1.17.0 an attacker can bypass authentication by presenting a JWT token with an issuer that is not in the provider list when Envoy's JWT Authentication filter is configured with the allowmissing requirement under...

CVE-2021-26864: Undefined Security Weakness

Windows Virtual Registry Provider Elevation of Privilege Vulnerability...

CVE-2021-3034

An information exposure through log file vulnerability exists in Cortex XSOAR software where the secrets configured for the SAML single sign-on SSO integration can be logged to the '/var/log/demisto/' server logs when testing the integration during setup. This logged information includes the...