Security Advisory - Improper Authorization Vulnerability in Some Huawei Products

There is an improper authorization vulnerability in some Huawei products. Due to improper authorization mangement, an attakcer can exploit this vulnerability by physical accessing the device and implant malicious code. Successfully exploit could leads to arbitrary code execution in the target...

PT-2021-4466

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions 6113 and prior Description The issue is related to an authentication bypass vulnerability in the REST API of Zoho ManageEngine ADSelfService Plus, which can lead to remote code execution. This...

OPENSUSE-SU-2021:1230-1 Security update for gstreamer-plugins-good

This update for gstreamer-plugins-good fixes the following issues: - CVE-2021-3498: Matroskademux: initialize track context out parameter to NULL before parsing bsc1184735. - CVE-2021-3497: Matroskademux: Fix extraction of multichannel WavPack bsc1184739. This update was imported from the...

Trend Micro Security family vulnerable to improper handling of Directory Junction

Overview Trend Micro Incorporated has released security updates for Trend Micro Security family. Trend Micro Incorporated reported this vulnerability to JPCERT/CC to notify users of the solutions through JVN. Impact An attacker may obtain unauthorized privileges and cause a denial-of-service DoS...

OPENSUSE-SU-2021:2915-1 Security update for gstreamer-plugins-good

This update for gstreamer-plugins-good fixes the following issues: - CVE-2021-3498: Matroskademux: initialize track context out parameter to NULL before parsing bsc1184735. - CVE-2021-3497: Matroskademux: Fix extraction of multichannel WavPack bsc1184739...

SUSE-SU-2021:2915-1 Security update for gstreamer-plugins-good

This update for gstreamer-plugins-good fixes the following issues: - CVE-2021-3498: Matroskademux: initialize track context out parameter to NULL before parsing bsc1184735. - CVE-2021-3497: Matroskademux: Fix extraction of multichannel WavPack bsc1184739...

The vulnerability of Schneider Electric Software Update’s software for updating products lies in its use of open redirection, allowing a hacker to execute arbitrary code.

The vulnerability of Schneider Electric Software Update’s software for product updates is related to the use of open redirection. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

DSA-4962-2 ledgersmb - regression update

Bulletin has no description...

GHSA-HGJR-632X-QPP3 Cross-site scripting vulnerability in file upload

There is a cross-site scripting vulnerability in file upload on the management system of baserCMS. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible...

GHSA-9F8F-574Q-8JMF Manipulation of product reviews via API

Impact Manipulation of product reviews via API Patches We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6 Workarounds For older versions of 6....

SUSE-SU-2021:2876-1 Security update for bind

This update for bind fixes the following issues: - CVE-2020-8622: A truncated TSIG response can lead to an assertion failure bsc1175443...

OPENSUSE-SU-2021:2874-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: Update to version 78.13 MFSA 2021-35, bsc1188891 - CVE-2021-29986: Race condition when resolving DNS names could have led to memory corruption - CVE-2021-29988: Memory corruption as a result of incorrect style treatment -...

MGASA-2021-0413 Updated libass packages fix security vulnerability

Updated libass packages fix security vulnerability: libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decodechars called from decodefont and processtext because the wrong integer data type is used for subtraction CVE-2020-36430...

OPENSUSE-SU-2021:2861-1 Security update for spectre-meltdown-checker

This update for spectre-meltdown-checker fixes the following issues: spectre-meltdown-checker was updated to version 0.44 bsc1189477 - feat: add support for SRBDS related vulnerabilities - feat: add zstd kernel decompression 370 - enh: arm: add experimental support for binary arm images - enh: rs...

baserCMS vulnerable to cross-site scripting

Overview baserCMS provided by baserCMS Users Community contains a cross-site scripting vulnerability CWE-79. Akagi Yusuke of NTT-ME CORPORATION reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An arbitrary...

DLA-2717-2 redis - regression update

Bulletin has no description...

CVE-2021-30594

Use after free in Page Info UI in Google Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption via physical access to the device...

GHSA-H6GG-FVF5-QGWF Data races in generator

The Generator type is an iterable which uses a generator function that yields values. In affected versions of the crate, the provided function yielding values had no Send bounds despite the Generator itself implementing Send. The generator function lacking a Send bound means that types that are...

CVE-2021-39136

baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site scripting vulnerability in the file upload function of the management system of baserCMS. Users are advised to update as soon as possible. No workaround are...

Cisco Application Policy Infrastructure Controller App Privilege Escalation Vulnerability

A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller APIC and Cisco Cloud Application Policy Infrastructure Controller Cloud APIC could allow an authenticated, remote attacker with Administrator read-only credentials to elevate privileges on an affected system...