PT-2021-4992 · Mcafee · Mcafee Total Protection

Name of the Vulnerable Software and Affected Versions: McAfee Total Protection versions prior to 16.0.30 Description: The issue is related to improper privilege management, allowing a local user to gain elevated privileges and execute arbitrary code, bypassing self-defense mechanisms. This can be...

libzip Resource Management Error Vulnerability

A resource management error vulnerability exists in libzip that arises from mismanagement of system resources e.g., memory, disk space, files, etc. by a networked system or product...

Adobe Magento 代码问题漏洞

Adobe Magento is Adobe's one with PHP written in open source e-commerce platform.Magento Community Edition is the community edition, later renamed Magento Open Source, Magento Enterprise Edition is the enterprise edition, later renamed Magento Magento Enterprise Edition is the enterprise edition,...

Adobe Magento SQL注入漏洞

Adobe Magento is Adobe's one with PHP written in open source e-commerce platform.Magento Community Edition is the community edition, later renamed Magento Open Source, Magento Enterprise Edition is the enterprise edition, later renamed Magento Magento Enterprise Edition is the enterprise edition,...

Beijing Legendary Huayu Education Technology Co., Ltd. digital resources cloud service platform has a logic flaw vulnerability

Beijing Legendary Huayu Education Technology Co., Ltd. is a company focusing on the role and development of unstructured data management and application in education and teaching. A logic flaw vulnerability exists in the digital resources cloud service platform of Beijing Legendary Huayu Educatio...

Kubernetes: API Server DoS (crash?) if many large resources (~1MB each) are concurrently/repeatedly sent to an external Validating WebHook endpoint

Report Submission Form Summary: I was trying to explore a way to stealthily send lots of data outside a private GKE cluster by way of misusing the Validating Webhook mechanism. The idea would be that a cluster-admin could install a webhook and then initiate resources like a secret or configmap th...

[SECURITY] [DLA 2546-1] intel-microcode security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2546-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta February 06, 2021 https://wiki.debian.org/LTS -...

Design/Logic Flaw

A frame-injection issue in the online help in Redwood Report2Web 4.3.4.5 allows remote attackers to render an external resource inside a frame via the help/OnlineHelp/NetHelp/default.htm turl parameter...

CVE-2021-26711

A frame-injection issue in the online help in Redwood Report2Web 4.3.4.5 allows remote attackers to render an external resource inside a frame via the help/OnlineHelp/NetHelp/default.htm turl parameter...

CVE-2021-1389 Cisco IOS XR and Cisco NX-OS Software IPv6 Access Control List Bypass Vulnerability

A vulnerability in the IPv6 traffic processing of Cisco IOS XR Software and Cisco NX-OS Software for certain Cisco devices could allow an unauthenticated, remote attacker to bypass an IPv6 access control list ACL that is configured for an interface of an affected device. The vulnerability is due ...

Authentication flaw

HCL OneTest UI V9.5, V10.0, and V10.1 does not perform authentication for functionality that either requires a provable user identity or consumes a significant amount of resources...

Wireshark 3.4.x < 3.4.3 Multiple Vulnerabilities

The version of Wireshark installed on the remote Windows host is prior to 3.4.3. It is, therefore, affected by vulnerabilities as referenced in the wireshark-3.4.3 advisory. - The USB HID dissector could leak memory. It may be possible to make Wireshark consume excessive CPU resources by injectin...

Wireshark 3.4.x < 3.4.3 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 3.4.3. It is, therefore, affected by vulnerabilities as referenced in the wireshark-3.4.3 advisory. - The USB HID dissector could leak memory. It may be possible to make Wireshark consume excessive CPU resources by...

Cisco IOS XR and Cisco NX-OS Software Access Control Error Vulnerability

Cisco NX-OS Software and Cisco IOS XR are both products of Cisco U.S.A. Cisco NX-OS Software is a suite of data center-class operating system software for switches. cisco IOS XR is a suite of operating systems developed for its network devices. cisco IOS XR and Cisco NX-OS Software is vulnerable ...

Security Bulletin: API Connect is impacted by a denial of service (DoS) vulnerability in Node.js (CVE-2020-11080)

Summary IBM API Connect has addressed the following vulnerability Vulnerability Details CVEID: CVE-2020-11080 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by an error in the HTTP/2 session frame which is limited to 32 settings by default. By sending overly large HTTP/2 SETTIN...

Arbitrary Code Execution

less-openui5 is vulnerable to arbitrary code execution. When processing theming resources i.e. .less files that originate from an untrusted source, the resources may contain JavaScript code which will be executed in the context of the build process...

FreeBSD : minio -- Server Side Request Forgery (8ec7d426-055d-46bc-8f5a-a9d73a5a71ab)

Minio developers report : Thanks to @phith0n from our community upon a code review, discovered an SSRF Server Side Request Forgery in our Browser API implementation. We have not observed this report/attack in the wild or reported elsewhere in the community at large. All users are advised to upgra...

CentOS 8 : kernel (CESA-2020:2102)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:2102 advisory. - Kernel: NetLabel: null pointer dereference while receiving CIPSO packet with null category may cause kernel panic CVE-2020-10711 - Kernel: s390: page...

CentOS 8 : libreoffice (CESA-2020:1598)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1598 advisory. - libreoffice: Remote resources protection module not applied to bullet graphics CVE-2019-9849 - libreoffice: Insufficient URL validation allowing...

PT-2021-14390 · Minio +1 · Minio +1

Name of the Vulnerable Software and Affected Versions: MinIO versions prior to RELEASE.2021-01-30T00-20-58Z Description: The issue is related to a server-side request forgery vulnerability. The target application may have functionality for importing data from a URL, publishing data to a URL, or...