CVE-2021-26559: Improper Access Control

Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when webserver exposeconfig is set to False in airflow.cfg. This allowed a privilege escalation attack...

Apache Airflow 安全漏洞

Apache Airflow is an Apache project maintained by the open source community dedicated to scheduling and monitoring workflows, open sourced by Airbnb in October 2014 and graduated from the Apache Foundation in January 2019 to become the new Apache top-level project. Failure of proper access contro...

Debian DSA-4852-1 : openvswitch - security update

Joakim Hindersson discovered that Open vSwitch, a software-based Ethernet virtual switch, allowed a malicious user to cause a denial-of-service by sending a specially crafted packet. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Stable Channel Update for Desktop

The Stable channel has been updated to 88.0.4324.182 for Windows, Mac and Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the log. Interested in switching release channels? Find out how here. If you find a new issue, please let us know by...

CVE-2020-22839

Reflected cross-site scripting vulnerability XSS in the evoadm.php file in b2evolution cms version 6.11.6-stable allows remote attackers to inject arbitrary webscript or HTML code via the tab3 parameter...

Remote code execution

Zoho ManageEngine OpManager Stable build before 125203 and Released build before 125233 allows Remote Code Execution via the Smart Update Manager SUM servlet...

PT-2021-11573

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine OpManager versions prior to 125203 Stable build and prior to 125233 Released build Description: The issue allows Remote Code Execution via the Smart Update Manager SUM servlet. This can be exploited for malicious purposes...

Google Chrome < 88.0.4324.146 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 88.0.4324.146. It is, therefore, affected by multiple vulnerabilities as referenced in the 202102stable-channel-update-for-desktop advisory. - Use after free in Navigation in Google Chrome prior to 88.0.4324.146 allowed...

Stable Channel Update for Desktop

The Stable channel has been updated to 88.0.4324.146 for Windows, Mac and Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the log. Interested in switching release channels? Find out how here. If you find a new issue, please let us know by...

CVE-2021-3156: Heap-Based Buffer Overflow in Sudo (Baron Samedit)

Update Feb 3, 2021: It has been reported that macOS, AIX, and Solaris are also vulnerable to CVE-2021-3156, and that others may also still be vulnerable. Qualys has not independently verified the exploit. Original Post: The Qualys Research Team has discovered a heap overflow vulnerability in sudo...

CVE-2021-3156 "Baron Samedit"

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via “sudoedit -s” and a command-line argument that ends with a single backslash character. Recent assessments: cdelafuente-r7 at January 27, 2021 3:40pm UTC...

CVE-2020-36213

The CVE-2020-36213 issue affects the abi_stable crate for Rust prior to 0.9.1. A retain call can produce an invalid UTF-8 string, violating soundness and potentially undermining memory-safety guarantees. Documented impact centers on Rust crate soundness rather than explicit exploit paths in the p...

Fedora 33 : flatpak (2021-f970ea9d79)

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-f970ea9d79 advisory. - This updates flatpak from 1.8 to new 1.10 stable series. The major new feature in this series compared to 1.8 is the support for the new repo format which...

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 88 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 88.0.4324.96 for Mac and Linux and 88.0.4324.104 for windows contains a number of fixes and improvements -- a list of changes...

[SECURITY] [DSA 4833-1] gst-plugins-bad1.0 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4833-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 18, 2021 https://www.debian.org/security/faq -...

CVE-2021-3004

The deposit function in the smart contract implementation for Stable Yield Credit yCREDIT, an Ethereum token, has certain incorrect calculations. An attacker can obtain more yCREDIT tokens than they should...

CVE-2021-3004: Incorrect Calculation

The deposit function in the smart contract implementation for Stable Yield Credit yCREDIT, an Ethereum token, has certain incorrect calculations. An attacker can obtain more yCREDIT tokens than they should...

PT-2021-18580

Name of the Vulnerable Software and Affected Versions Stable Yield Credit yCREDIT affected versions not specified Description The issue concerns incorrect calculations in the deposit function of the smart contract implementation for Stable Yield Credit yCREDIT, an Ethereum token. This allows an...

Stable Yield Credit Security Breach

Stable Yield Credit is a new protocol for decentralized lending, stablecoin, and automated market maker AMM in one for the Stable Yield Credit community. Stable Yield Credit suffers from a security vulnerability that stems from certain miscalculations in the deposit function. An attacker could...

PT-2020-17585

Name of the Vulnerable Software and Affected Versions abi stable crate versions prior to 0.9.1 Description The issue concerns soundness bugs in the abi stable crate for Rust, where a retain call can create an invalid UTF-8 string and DrainFilter lacks soundness due to a double drop. These bugs ar...