OPENSUSE-SU-2021:0513-1 Security update for chromium

This update for chromium fixes the following issues: Update to 89.0.4389.114 boo1184256 - CVE-2021-21194: Use after free in screen capture - CVE-2021-21195: Use after free in V8 - CVE-2021-21196: Heap buffer overflow in TabStrip - CVE-2021-21197: Heap buffer overflow in TabStrip - CVE-2021-21198:...

CVE-2021-22999

On versions 15.0.x before 15.1.0 and 14.1.x before 14.1.4, the BIG-IP system provides an option to connect HTTP/2 clients to HTTP/1.x servers. When a client is slow to accept responses and it closes a connection prematurely, the BIG-IP system may indefinitely retain some streams unclosed. Note:...

Code injection

On versions 15.0.x before 15.1.0 and 14.1.x before 14.1.4, the BIG-IP system provides an option to connect HTTP/2 clients to HTTP/1.x servers. When a client is slow to accept responses and it closes a connection prematurely, the BIG-IP system may indefinitely retain some streams unclosed. Note:...

Design/Logic Flaw

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, on systems with Advanced WAF or BIG-IP ASM provisioned, the Traffic Management User Interface TMUI, also referred to as the...

Samsung Cloud 授权问题漏洞

Samsung Cloud is an application from the South Korean company Samsung Samsung. It is used to provide a function to save and view pictures. A security vulnerability exists in Samsung Cloud prior to version 4.7.0.3 that allows an attacker to intercept the provider when it is executed. No details of...

CVE-2021-27906

A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions...

F5 Networks BIG-IP : Advanced WAF/ASM TMUI authenticated remote command execution vulnerability (K45056101)

The version of F5 Networks BIG-IP installed on the remote host is prior to 11.6.5.3 / 12.1.5.3 / 13.1.3.6 / 14.1.4 / 15.1.2.1 / 16.0.1.1 / 16.1.0. It is, therefore, affected by a vulnerability as referenced in the K45056101 advisory. - On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before...

Aruba Networks AirWave Management Platform Cross-Site Scripting Vulnerability (CNVD-2021-15039)

Aruba Networks AirWave Management Platform is a suite of network management software for multi-vendor management from Aruba Networks. The software provides real-time monitoring, proactive alerting and historical data reporting. A stored cross-site scripting vulnerability exists in the web...

PrestaShop CSV Injection Vulnerability

PrestaShop is a full-featured, cross-platform, free and open source e-commerce solution designed for web 2.0. A CSV injection vulnerability exists in PrestaShop versions prior to 1.7.2. An attacker can exploit this vulnerability by using the store search keyword in the admin panel to conduct a CS...

OPENSUSE-SU-2021:0277-1 Security update for librepo

This update for librepo fixes the following issues: - Upgrade to 1.12.1 + Validate path read from repomd.xml bsc1175475, CVE-2020-14352 - Changes from 1.12.0 + Prefer mirrorlist/metalink over baseurl rh1775184 + Decode package URL when using for local filename rh1817130 + Fix memory leak in...

OPENSUSE-SU-2021:0267-1 Security update for chromium

This update for chromium fixes the following issues: Update to 88.0.4324.150 boo1181827 - CVE-2021-21148: Heap buffer overflow in V8...

Star Computer Star Practice Management Web 访问控制错误漏洞

Star Computer Star Practice Management Web is a web service from Star Computer UK that applies billing based on time.An access control error vulnerability exists in Star Practice Management Web version 2019.2.0.6, which could be exploited by an unauthorized The vulnerability can be exploited by a...

SUSE-SU-2021:0197-1 Security update for permissions

This update for permissions fixes the following issues: - Update to version 20181224: pcp: remove no longer needed / conflicting entries bsc1171883, CVE-2020-8025...

PT-2021-14080 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to 4.2.3 Description: A cross-site scripting issue allows remote attackers to inject an arbitrary script via unspecified vectors. Recommendations: For versions prior to 4.2.3, update to version 4.2.3 or later to resolve t...

CVE-2020-26733

Cross Site Scripting XSS in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 allows authenticated attacker to inject their own script into the page via DDNS Configuration Section...

Cross site scripting

Cross Site Scripting XSS in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 allows authenticated attacker to inject their own script into the page via DDNS Configuration Section...

CVE-2020-26733

Cross Site Scripting XSS in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 allows authenticated attacker to inject their own script into the page via DDNS Configuration Section...

CVE-2020-26732

SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

CVE-2020-26732

SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

SUSE-SU-2021:0027-1 Security update for dovecot23

This update for dovecot23 fixes the following issues: Security issues fixed: - CVE-2020-12100: Fixed a resource exhaustion caused by deeply nested MIME parts bsc1174920. - CVE-2020-24386: Fixed an issue with IMAP hibernation that allowed users to access other users' emails bsc1180405. -...