UVI-2021-1000547 mptcp: fix data stream corruption

mptcp: fix data stream corruption This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.12.9 by commit 18e7f0580da15cac1e79d73683ada5a9e70980f8, it...

OPENSUSE-SU-2021:0833-1 Security update for ceph

This update for ceph fixes the following issues: - Update to 15.2.12-83-g528da226523: - CVE-2021-3509 fix cookie injection issue bsc1186021 - CVE-2021-3531 RGWSwiftWebsiteHandler::iswebdir checks empty subdirname bsc1186020 - CVE-2021-3524 sanitize \r in s3 CORSConfiguration’s ExposeHeader...

CVE-2021-26584

A security vulnerability in HPE OneView for VMware vCenter OV4VC could be exploited remotely to allow Cross-Site Scripting. HPE has released the following software update to resolve the vulnerability in HPE OneView for VMware vCenter OV4VC...

CVE-2021-26584

A security vulnerability in HPE OneView for VMware vCenter OV4VC could be exploited remotely to allow Cross-Site Scripting. HPE has released the following software update to resolve the vulnerability in HPE OneView for VMware vCenter OV4VC...

CVE-2021-26584

A security vulnerability in HPE OneView for VMware vCenter OV4VC could be exploited remotely to allow Cross-Site Scripting. HPE has released the following software update to resolve the vulnerability in HPE OneView for VMware vCenter OV4VC...

CVE-2021-32923

Summary: CVE-2021-32923 affects HashiCorp Vault and Vault Enterprise. The issue arises from the renewal logic for nearly-expired token leases and dynamic secret leases within one second of their maximum TTL, which allowed these leases to be incorrectly treated as non-expiring during subsequent us...

PT-2021-17934 · Qnap Systems · Quts Hero +3

Name of the Vulnerable Software and Affected Versions: QNAP Systems Inc. Video Station versions prior to 5.5.4 on QTS 4.5.2 QNAP Systems Inc. Video Station versions prior to 5.5.4 on QuTS hero h4.5.2 QNAP Systems Inc. Video Station versions prior to 5.5.4 on QuTScloud c4.5.4 Description: A comman...

Cisco Webex Meetings, Webex Network Recording Player, and Webex Teams DLL Injection Vulnerability

A vulnerability in Cisco Webex Meetings Desktop App for Windows, Cisco Webex Meetings Server, Cisco Webex Network Recording Player for Windows, and Cisco Webex Teams for Windows could allow an authenticated, local attacker to perform a DLL injection attack on an affected device. To exploit this...

Cisco SD-WAN Software Privilege Escalation Vulnerability

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges on an affected system. This vulnerability exists because the affected software does not properly restrict access to privileged processes. An attacker could exploit this...

SUSE-SU-2021:1835-1 Security update for ceph

This update for ceph fixes the following issues: - Update to 15.2.12-83-g528da226523: - CVE-2021-3509 fix cookie injection issue bsc1186021 - CVE-2021-3531 RGWSwiftWebsiteHandler::iswebdir checks empty subdirname bsc1186020 - CVE-2021-3524 sanitize \r in s3 CORSConfiguration’s ExposeHeader...

Security Advisory - Improper Permission Assignment Vulnerability in Some USB Dongle Products

Huawei LTE USB Dongle products have an improper permission assignment vulnerability. An attacker can locally access and log in to a MAC OS to induce a user to install a specially crafted application. After successfully exploiting this vulnerability, the attacker can perform unauthenticated...

DSA-4925-1 firefox-esr - security update

Bulletin has no description...

PT-2021-7435 · Nginx · Nginx Controller

Name of the Vulnerable Software and Affected Versions: NGINX Controller versions 2.0.0 through 2.9.0 NGINX Controller versions 3.x before 3.15.0 Description: The issue is related to insufficient protection of registration data, which may allow an attacker to disclose protected information...

SUSE-SU-2021:1809-1 Security update for curl

This update for curl fixes the following issues: - CVE-2021-22876: Fixed an issue where the automatic referer was leaking credentials bsc1183933. - CVE-2021-22898: Fixed curl TELNET stack contents disclosure bsc1186114. - Fix for SFTP uploads when it results in empty uploaded files bsc1177976. -...

OPENSUSE-SU-2021:0808-1 Security update for curl

This update for curl fixes the following issues: - CVE-2021-22898: Fixed curl TELNET stack contents disclosure bsc1186114. - Allow partial chain verification jscSLE-17956 Have intermediate certificates in the trust store be treated as trust-anchors, in the same way as self-signed root CA...

USN-4969-2 isc-dhcp vulnerability

USN-4969-1 fixed a vulnerability in DHCP. This update provides the corresponding update for Ubuntu 14.04 ESM and 16.04 ESM. Original advisory details: Jon Franklin and Pawel Wieczorkiewicz discovered that DHCP incorrectly handled lease file parsing. A remote attacker could possibly use this issue...

HPESBGN04151 rev.1 - HPE OneView for VMware vCenter, Remote Cross-Site Scripting

Potential Security Impact: Remote: Cross-Site Scripting XSS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE OneView for VMware vCenter with Operations Manager and Log Insight - Prior to 10.2 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2021-26584 |...

PT-2021-15259 · Unknown · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: Rocket.Chat versions prior to 3.13 Rocket.Chat version 3.12.2 Rocket.Chat version 3.11.3 Description: An information disclosure issue exists in the Rocket.Chat server that allows email addresses to be disclosed through enumeration and...

Zettlr vulnerable to cross-site scripting

Overview Zettlr provided by Hendrik Erz is a Markdown editor. Zettlr contains a cross-site scripting vulnerability CWE-79. Eiji Mori of flatt security Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact If ...

PT-2021-3340 · 3S Smart Software Solutions · Codesys V2 Runtime System

Name of the Vulnerable Software and Affected Versions: CODESYS V2 runtime system SP versions prior to 2.4.7.55 Description: The issue arises from the improper neutralization of special elements used in an OS command, potentially allowing an attacker to impact the confidentiality, integrity, and...