Debian DLA-2867-1 : spip - LTS security update

The remote Debian 9 host has a package installed that is affected by a vulnerability as referenced in the dla-2867 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 70300 C Tenable Network Security...

ALSA-2021:5235 Moderate: postgresql:12 security update

PostgreSQL is an advanced object-relational database management system DBMS. The following packages have been upgraded to a later upstream version: postgresql 12.9. Security Fixes: postgresql: memory disclosure in certain queries CVE-2021-3677 postgresql: server processes unencrypted bytes from...

CVE-2021-41772 affecting package golang 1.16.9-1

CVE-2021-41772 affecting package golang 1.16.9-1. An upgraded version of the package is available that resolves this issue...

AZL-7025 CVE-2021-43818 affecting package python-lxml for versions less than 4.8.0-1

lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant...

PYSEC-2021-852

lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant...

Authentication flaw

Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2,...

CVE-2021-22565

CVE-2021-22565 affects the Google Exposure Notifications Verification Server. Root cause: insufficient granularity of access control in the verification-server component, enabling an attacker with permission to expire verification codes to invalidate codes that belong to another realm if the UUID...

GHSA-8GW6-W5RW-4G5C Incorrect Default Permissions in Apache JSPWiki

Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later...

CVE-2021-44140

Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later...

Exploit for Code Injection in Gitlab

CVE-2021-22205-getshell CVE-2021-22205-getshell Test v...

CVE-2021-22557

SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We recommend upgrading SLO Generator past https://github.com/google/slo-generator/pull/173...

USN-5079-3 curl vulnerabilities

USN-5079-1 fixed vulnerabilities in curl. One of the fixes introduced a regression on Ubuntu 18.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that curl incorrect handled memory when sending data to an MQTT server. A remote...

CVE-2021-39180 Path Traversal in Archive Handling Leading to Code Execution

OpenOLAT is a web-based learning management system LMS. A path traversal vulnerability exists in versions prior to 15.3.18, 15.5.3, and 16.0.0. Using a specially prepared ZIP file, it is possible to overwrite any file that is writable by the application server user e.g. the tomcat user. Depending...

CVE-2021-2307 affecting package mysql 8.0.23-1

CVE-2021-2307 affecting package mysql 8.0.23-1. An upgraded version of the package is available that resolves this issue...

CVE-2019-12855 affecting package python-twisted 19.2.1-5

CVE-2019-12855 affecting package python-twisted 19.2.1-5. An upgraded version of the package is available that resolves this issue...

CVE-2020-27783 affecting package python-lxml 4.2.4-7

CVE-2020-27783 affecting package python-lxml 4.2.4-7. An upgraded version of the package is available that resolves this issue...

CVE-2018-19787 affecting package python-lxml 4.2.4-7

CVE-2018-19787 affecting package python-lxml 4.2.4-7. An upgraded version of the package is available that resolves this issue...

CVE-2021-29148

A local cross-site scripting XSS vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series versions: Aruba AOS-CX firmware: 10.04.xxxx ...

CVE-2021-31525 affecting package golang 1.15.11-1

CVE-2021-31525 affecting package golang 1.15.11-1. An upgraded version of the package is available that resolves this issue...

Unchecked hostname resolution could allow access to local network resources by users outside the local network

Impact A newly implemented route allowing users to download files from remote endpoints was not properly verifying the destination hostname for user provided URLs. This would allow malicious users to potentially access resources on local networks that would otherwise be inaccessible. This...