Poorly Configured Apache Airflow Instances Leak Credentials for Popular Services

Cybersecurity researchers on Monday discovered misconfigurations across older versions of Apache Airflow instances belonging to a number of high-profile companies across various sectors, resulting in the exposure of sensitive credentials for popular platforms and services such as Amazon Web...

ManageEngine ADAudit Plus Authenticated File Write RCE

This module exploits security issues in ManageEngine ADAudit Plus prior to 7006 that allow authenticated users to execute arbitrary code by creating a custom alert profile and leveraging its custom alert script component. The module first runs a few checks to test the provided credentials, retrie...

MGASA-2021-0444 Updated gstreamer packages fix security issues

GStreamer has been updated to 1.18.5 to fix various bugs and some security issues...

Updated gstreamer packages fix security issues

GStreamer has been updated to 1.18.5 to fix various bugs and some security issues...

SUSE-RU-2021:3162-1 Recommended update for SUSE Manager 4.2.2 Release Notes

This update for SUSE Manager 4.2.2 Release Notes provides the following additions: Release notes for SUSE Manager: - Update to 4.2.2 SUSE Manager is now able to manage Rocky Linux 8 clients Tech Preview: Inter-Server Sync V2 Bugs mentioned bsc1171483, bsc1173143, bsc1181223, bsc1186281, bsc118633...

[slackware-security] httpd

New httpd packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/httpd-2.4.49-i586-1slack14.2.txz: Upgraded. This release contains security fixes and improvements. modproxy: Server Side...

OPENSUSE-SU-2021:1255-1 Security update for nextcloud

This update for nextcloud fixes the following issues: Update to 20.0.12 Fix boo1190291 - CVE-2021-32766 CWE-209: Generation of Error Message Containing Sensitive Information - CVE-2021-32800 CWE-306: Missing Authentication for Critical Function - CVE-2021-32801 CWE-532: Insertion of Sensitive...

USN-5074-1: Firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, bypass mixed content blocking, or execute arbitrary code...

SUSE: Security Advisory (SUSE-SU-2021:2955-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2021:2922-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2021:2923-1 Security update for xen

This update for xen fixes the following issues: Update to Xen 4.13.3 general bug fix release bsc1027519. Security issues fixed: - CVE-2021-28693: xen/arm: Boot modules are not scrubbed bsc1186428 - CVE-2021-28692: xen: inappropriate x86 IOMMU timeout detection / handling bsc1186429 - CVE-2021-008...

GHSA-Q4RF-3FHX-88PF YAML deserialization can run untrusted code

Impact An authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with a crafted aclpolicy yaml file, that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition. An...

SUSE: Security Advisory (SUSE-SU-2021:2890-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 8 : microcode_ctl (RHSA-2021:3364)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:3364 advisory. The microcodectl packages provide microcode updates for Intel. Security Fixes: hw: Vector Register Data Sampling CVE-2020-0548 hw: L1D Cache...

USN-5058-1: Thunderbird vulnerabilities

It was discovered that Thunderbird didn't ignore IMAP server responses prior to completion of the STARTTLS handshake. A person-in-the-middle could potentially exploit this to trick Thunderbird into showing incorrect information. CVE-2021-29969 Multiple security issues were discovered in...

Multiple security issues including data race, buffer overflow, and uninitialized memory drop in arr

arr crate contains multiple security issues. Specifically, 1. It incorrectly implements Sync/Send bounds, which allows to smuggle non-Sync/Send types across the thread boundary. 2. Index and IndexMut implementation does not check the array bound. 3. Array::newfromtemplate drops uninitialized memo...

SUSE-SU-2021:2842-1 Security update for the Linux Kernel (Live Patch 39 for SLE 12 SP3)

This update for the Linux Kernel 4.4.180-94144 fixes several issues. The following security issues were fixed: - CVE-2021-37576: On the powerpc platform KVM guest OS users could cause host OS memory corruption via rtasargs.nargs bsc1188838. - CVE-2021-3609: Fixed a local privilege escalation via ...

USN-5037-2: Firefox regression

USN-5037-1 fixed vulnerabilities in Firefox. The update introduced a regression that caused Firefox to repeatedly prompt for a password. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Multiple security issues were discovered in Firefox. If a user wer...

CVE-2021-31009

Multiple issues were addressed by removing HDF5. This issue is fixed in iOS 15.2 and iPadOS 15.2, macOS Monterey 12.1. Multiple issues in HDF5...

SUSE-SU-2021:2833-1 Security update for openssl-1_1

This update for openssl-11 fixes the following security issues: - CVE-2021-3711: A bug in the implementation of the SM2 decryption code could lead to buffer overflows. bsc1189520 - CVE-2021-3712: a bug in the code for printing certificate details could lead to a buffer overrun that a malicious...