CVE-2021-32610: Improper Link Resolution Before File Access

In ArchiveTar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193...

Important: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

[ASA-202107-48] linux: privilege escalation

Arch Linux Security Advisory ASA-202107-48 ========================================== Severity: High Date : 2021-07-21 CVE-ID : CVE-2021-3609 CVE-2021-3612 CVE-2021-33909 Package : linux Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-2181 Summary ======= The...

Froala WYSIWYG Editor Cross-Site Scripting Vulnerability

Froala WYSIWYG Editor is an application. Froala WYSIWYG Editor is a cross-site scripting vulnerability that stems from an obfuscation of namespace resolution in the product. An attacker could exploit this vulnerability to obtain an administrator cookie...

DNSStager - Hide Your Payload In DNS

DNSStager is an open-source project based on Python used to hide and transfer your payload using DNS. DNSStager will create a malicious DNS server that handles DNS requests to your domain and return your payload as a response to specific record requests such as AAAA or TXT records after splitting...

2021-07 Cumulative Update for Windows 10 Version 1909 for x64-based Systems (KB5004245)

Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information. After you install this item, you may have to restart your computer...

Design/Logic Flaw

dandavison delta before 0.8.3 on Windows resolves an executable's pathname as a relative path from the current directory...

CVE-2021-36376

dandavison delta before 0.8.3 on Windows resolves an executable's pathname as a relative path from the current directory...

CVE-2021-36376: Uncontrolled Search Path Element

dandavison delta before 0.8.3 on Windows resolves an executable's pathname as a relative path from the current directory...

PT-2021-21258

Name of the Vulnerable Software and Affected Versions dandavison delta version 0.8.2 and earlier git-delta version 0.8.2 and earlier Description The issue arises when the software resolves an executable's pathname as a relative path from the current directory on Windows. This could potentially le...

runC: Container breakout

Background runC is a CLI tool for spawning and running containers according to the OCI specification. Description A vulnerability in runC could allow an attacker to achieve privilege escalation if specific mount configuration prerequisites are satisfied. Impact An attacker may be able to escalati...

Design/Logic Flaw

The API /vsaWS/KaseyaWS.asmx can be used to submit XML to the system. When this XML is processed external entities are insecurely processed and fetched by the system and returned to the attacker. Detailed description Given the following request: POST /vsaWS/KaseyaWS.asmx HTTP/1.1 Content-Type:...

CVE-2021-30201

CVE-2021-30201 affects Kaseya VSA (on‑premises/server side) where the API /vsaWS/KaseyaWS.asmx processes XML with external entities. The vulnerability arises from insecure handling of XML external entities, allowing an attacker to cause the server to read local files (e.g., c:\kaseya\kserver\kser...

Redis: Multiple vulnerabilities

Background Redis is an open source BSD licensed, in-memory data structure store, used as a database, cache and message broker. Description Multiple vulnerabilities have been discovered in Redis. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CV...

Jinja: Denial of service

Background Jinja is a template engine written in pure Python. Description The ‘urlize’ filter in Jinja utilized an inefficient regular expression that could be exploited to consume excess CPU. Impact An attacker could cause a Denial of Service condition via crafted input to the ‘urlize’ Jinja...

2021-07 Cumulative Update for Windows 10 Version 21H1 for ARM64-based Systems (KB5004945)

Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information. After you install this item, you may have to restart your computer...

XXE vulnerability in Jenkins Selenium HTML report Plugin

Jenkins Selenium HTML report Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers with the ability to control the report files parsed using this plugin to have Jenkins parse a crafted report file that uses external entities for...

Advisory ROSA-SA-2021-1942

Software: orca 3.6.3 OS: Cobalt 7.9 CVE-ID: CVE-2020-9298 CVE-Crit: HIGH CVE-DESC: The spinnaker template resolution feature is vulnerable to server-side request forgery SSRF, which allows an attacker to send requests on behalf of the spinnaker, potentially exposing sensitive data. CVE-STATUS:...

PT-2021-3509

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise Linux affected versions not specified Description The issue is related to the RPM package manager in Red Hat Enterprise Linux, where there is an incorrect link resolution before accessing a file. This can allow an attacker t...

GHSA-2JX8-V4HV-GX3H XXE vulnerability in Launch import

| Release Date | Affected Projects | Affected Versions | Access Vector| Security Risk | |--------------|-------------------|-------------------|---------------|---------------| | Monday, May 4, 2020| service-api | Every version, starting from 3.1.0 | Remote | Medium | Impact Starting from version...