Huawei EulerOS: Security Advisory for python3 (EulerOS-SA-2021-1747)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for python3 (EulerOS-SA-2021-1722)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security fix for the ALT Linux 9 package python3-module-django version 2.2.19-alt1

2.2.19-alt1 built April 12, 2021 Alexey Shabalin in task 266900 Feb. 24, 2021 Alexey Shabalin - 2.2.19 - rename package to python3-module-django back - Fixes for the following security vulnerabilities: + CVE-2021-3281 Potential directory-traversal via archive.extract + CVE-2021-23336 Web cache...

Critical Photon OS Security Update - PHSA-2021-0007

Updates of 'linux-aws', 'containerd', 'linux-secure', 'glib', 'libtiff', 'linux-rt', 'curl', 'linux', 'libvirt', 'openssl', 'mysql', 'wpasupplicant', 'apache-tomcat', 'python3', 'nodejs', 'docker' packages of Photon OS have been released...

Photon OS 4.0: Python3 PHSA-2021-4.0-0007

An update of the python3 package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-4.0-0007. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid148348;...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Django vulnerability (USN-4902-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4902-1 advisory. Dennis Brinkrolf discovered that Django incorrectly handled certain filenames. A remote attacker could possibly use this issue to create o...

OpenEMR 4.1.0 SQL Injection

Exploit Title: OpenEMR 4.1.0 - 'u' SQL Injection Date: 2021-04-03 Exploit Author: Michael Ikua Vendor Homepage: https://www.open-emr.org/ Software Link: https://github.com/openemr/openemr/archive/refs/tags/v410.zip Version: 4.1.0 Original Advisory:...

Critical Photon OS Security Update - PHSA-2021-4.0-0007

Updates of 'mysql', 'apache-tomcat', 'curl', 'libtiff', 'linux-aws', 'glib', 'nodejs', 'python3', 'containerd', 'docker', 'wpasupplicant', 'linux-secure', 'linux-rt', 'linux', 'openssl', 'libvirt' packages of Photon OS have been released...

Updated python and python3 packages fix security vulnerability

Updated python and python3 security vulnerability: The package python/cpython is vulnerable to Web Cache Poisoning via urllib.parse.parseqsl and urllib.parse.parseqs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon ;, they can cause a...

Exploit for Server-Side Request Forgery in Vmware Cloud_Foundation

CVE-2021-21975 SSRF-POC - ssrf to cred leak First configur...

GHSA-MPVW-25MG-59VX Server-side Request Forgery (SSRF) via img tags in reportlab

All versions of package reportlab at time of writing are vulnerable to Server-side Request Forgery SSRF via img tags. In order to reduce risk, use trustedSchemes & trustedHosts see in Reportlab's documentation Steps to reproduce by Karan Bamal: 1. Download and install the latest package of...

SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2021:0947-1)

This update for python3 fixes the following issues : python36 was updated to 3.6.13 CVE-2021-23336: Fixed a potential web cache poisoning by using a semicolon in query parameters use of semicolon as a query string separator bsc1182379. Note that Tenable Network Security has extracted the precedin...

Dolibarr ERP/CRM 11.0.4 Bypass / Code Execution

Exploit Title: Dolibarr ERP/CRM 11.0.4 - File Upload Restrictions Bypass Authenticated RCE Date: 16/06/2020 Exploit Author: Andrea Gonzalez Vendor Homepage: https://www.dolibarr.org/ Software Link: https://github.com/Dolibarr/dolibarr Version: Prior to 11.0.5 Tested on: Debian 9.12 CVE :...

SUSE-SU-2021:0947-1 Security update for python3

This update for python3 fixes the following issues: - python36 was updated to 3.6.13 - CVE-2021-23336: Fixed a potential web cache poisoning by using a semicolon in query parameters use of semicolon as a query string separator bsc1182379...

SUSE SLES12 Security Update : python3 (SUSE-SU-2021:0886-1)

This update for python3 fixes the following issues : CVE-2021-23336: Fixed a potential web cache poisoning by using a semicolon in query parameters use of semicolon as a query string separator bsc1182379. Note that Tenable Network Security has extracted the preceding description block directly fr...

[SECURITY] Fedora 34 Update: pyatspi-2.38.1-1.fc34

at-spi allows assistive technologies to access GTK-based applications. Essentially it exposes the internals of applications for automation, so tools such as screen readers, magnifiers, or even scripting interfaces can query and interact with GUI controls. This package includes a python3 client...

Fedora: Security Advisory for mingw-python3 (FEDORA-2021-e525e48886)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 34 Update: mingw-python3-3.9.2-2.fc34

MinGW Windows python3 library...

Exploit for Server-Side Request Forgery in F5 Big-Ip_Access_Policy_Manager

Usage python3 f5rce.py -u Target URL -f Batch detectio...

Rocket.Chat: Pre-Auth Blind NoSQL Injection leading to Remote Code Execution

Summary: The getPasswordPolicy method is vulnerable to NoSQL injection attacks and does not require authentication/authorization. It can be used to take over accounts by leaking password reset tokens. Taking over an admin account leads to Remote Code Execution. Description: The getPasswordPolicy...