CVE-2021-41150

Tough provides a set of Rust libraries and tools for using and generating the update framework TUF repositories. The tough library, prior to 0.12.0, does not properly sanitize delegated role names when caching a repository, or when loading a repository from the filesystem. When the repository is...

Code injection

Tough provides a set of Rust libraries and tools for using and generating the update framework TUF repositories. The tough library, prior to 0.12.0, does not properly sanitize delegated role names when caching a repository, or when loading a repository from the filesystem. When the repository is...

CVE-2021-41150

CVE-2021-41150 affects the Tough Rust library (pre-0.12.0). The issue is improper sanitization of delegated role names when caching or loading a repository, allowing files ending with .json to be overwritten with role metadata anywhere on the system. This is caused by insufficient handling during...

CVE-2021-41149 Improper sanitization of target names in tough

Tough provides a set of Rust libraries and tools for using and generating the update framework TUF repositories. The tough library, prior to 0.12.0, does not properly sanitize target names when caching a repository, or when saving specific targets to an output directory. When targets are cached o...

Tough Library Path Traversal Vulnerability

tough library is a tool for using and generating TUF repositories. A security vulnerability exists in versions prior to Tough library 0.12.0 that stems from the program's inability to properly clean up delegated role names when caching a repository or loading a repository from the file system...

CVE-2021-41155

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions Tuleap does not sanitize properly user inputs when constructing the SQL query to browse and search revisions in the CVS repositories. The following versions contain the fix:...

CVE-2021-41155 SQL injection in CVS revisions browser

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions Tuleap does not sanitize properly user inputs when constructing the SQL query to browse and search revisions in the CVS repositories. The following versions contain the fix:...

CVE-2021-41155

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions Tuleap does not sanitize properly user inputs when constructing the SQL query to browse and search revisions in the CVS repositories. The following versions contain the fix:...

PT-2021-23135

Name of the Vulnerable Software and Affected Versions Tuleap versions prior to 11.17.99.146 Tuleap Enterprise Edition versions prior to 11.17-5 Tuleap Enterprise Edition versions prior to 11.16-7 Description Tuleap does not properly sanitize user inputs when constructing SQL queries to browse and...

CVE-2021-41155: Improper Neutralization of Special Elements used in an SQL Command

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions Tuleap does not sanitize properly user inputs when constructing the SQL query to browse and search revisions in the CVS repositories. The following versions contain the fix:...

Beware! This Android Trojan Stole Millions of Dollars from Over 10 Million Users

A newly discovered "aggressive" mobile campaign has infected north of 10 million users from over 70 countries via seemingly innocuous Android apps that subscribe the individuals to premium services costing €36 $42 per month without their knowledge. Zimperium zLabs dubbed the malicious trojan...

subscription-manager bug fix and enhancement update

An update is available for subscription-manager. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The subscription-manager packages provide programs and libraries...

rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source

A flaw was found in the way Bundler determined the source repository when installing dependencies of source-restricted gem packages. In configurations that use multiple gem repositories and explicitly define from which source repository certain gems are to be installed, a dependency of a...

CVE-2021-41033

In all released versions of Eclipse Equinox, at least until version 4.21 September 2021, installation can be vulnerable to man-in-the-middle attack if using p2 repos that are HTTP; that can then be exploited to serve incorrect p2 metadata and entirely alter the local installation, particularly by...

CVE-2021-41033

In all released versions of Eclipse Equinox, at least until version 4.21 September 2021, installation can be vulnerable to man-in-the-middle attack if using p2 repos that are HTTP; that can then be exploited to serve incorrect p2 metadata and entirely alter the local installation, particularly by...

Eclipse Equinox security vulnerabilities

Eclipse Equinox is a sub-project of the Eclipse Foundation that provides a certified implementation of the OSGi R4.x core framework specification. versions prior to Eclipse Equinox 4.21 have a security vulnerability that stems from the fact that if a p2 repository with HTTP is used, an attacker...

PT-2021-23056

Name of the Vulnerable Software and Affected Versions Eclipse Equinox versions prior to 4.21 Description The issue allows for a man-in-the-middle attack when using HTTP p2 repositories, potentially leading to the installation of malicious plug-ins that can run malicious code by serving incorrect ...

Privilege Escalation

centraldogma-server is vulnerable to privilege escalation. A user with file managing privileges of the project is able to mirror to internal repositories...

What are the storage space requirements for successful VM migration across Storage repositories?

When performing storage xenmotion moving of disks from one SR to another while it is attached to a VM that is running, it fails with insufficient space...

openSUSE: Security Advisory for libdnf (openSUSE-SU-2021:2685-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...