CVE-2021-21352

Anuko Time Tracker (PHP) before version 1.19.24.5415 uses time-based tokens in the password-reset feature, enabling brute-force guessing to change user passwords (including admin). The issue is addressed in 1.19.24.5415 (better tokens) and further limited in 1.19.24.5416 with a reduced brute-forc...

CVE-2021-21352 Predictable tokens used for password resets

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In TimeTracker before version 1.19.24.5415 tokens used in password reset feature in Time Tracker are based on system time and, therefore, are predictable. This opens a window for brute force attacks to guess...

Debian: Security Advisory (DLA-2581-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-2579-1 : spip security update

It was discovered that SPIP, a website engine for publishing, would allow a malicious user to perform cross-site scripting attacks, access sensitive information, or execute arbitrary code. For Debian 9 stretch, this problem has been fixed in version 3.1.4-4deb9u4+deb9u1. We recommend that you...

Debian DLA-2581-1 : wpa security update

A vulnerability was discovered in how p2p/p2ppd.c in wpasupplicant before 2.10 processes P2P Wi-Fi Direct provision discovery requests. It could result in denial of service or other impact potentially execution of arbitrary code, for an attacker within radio range. For Debian 9 stretch, this...

[SECURITY] [DLA 2581-1] wpa security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2581-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta March 03, 2021 https://wiki.debian.org/LTS -...

Debian DLA-2578-1 : thunderbird security update

Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code or information disclosure. For Debian 9 stretch, these problems have been fixed in version 1:78.8.0-1deb9u1. We recommend that you upgrade your thunderbird packages. For the detailed...

[SECURITY] [DLA 2578-1] thunderbird security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2578-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort March 01, 2021 https://wiki.debian.org/LTS -...

Debian DLA-2577-1 : python-pysaml2 security update

Several issues have been found in python-pysaml2, a pure python implementation of SAML Version 2 Standard. CVE-2017-1000433 pysaml2 accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password. CVE-2021-21239 pysaml2 ha...

[SECURITY] [DLA 2575-1] firefox-esr security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2575-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort February 25, 2021 https://wiki.debian.org/LTS -...

Debian DLA-2564-1 : php-horde-text-filter security update

Alex Birnberg discovered a cross-site scripting XSS vulnerability in the Horde Application Framework, more precisely its Text Filter API. An attacker could take control of a user's mailbox by sending a crafted e-mail. CVE-2021-26929 An XSS issue was discovered in Horde Groupware Webmail Edition...

[SECURITY] [DLA 2564-1] php-horde-text-filter security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2564-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler February 18, 2021 https://wiki.debian.org/LTS -...

Debian DLA-2562-1 : mumble security update

It was discovered that there was a a remote code execution vulnerability in mumble, a VoIP client commonly used for group chats. The exploit could have been been triggered by a maliciously crafted URL on the server list. For Debian 9 'Stretch', this problem has been fixed in version...

[SECURITY] [DLA 2566-1] libbsd security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2566-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz February 18, 2021 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2565-1] openssl1.0 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2565-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb February 18, 2021 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2560-1] qemu security update

Debian LTS Advisory DLA-2560-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler February 18, 2021 https://wiki.debian.org/LTS Package : qemu Version : 1:2.8+dfsg-6+deb9u13 CVE ID : CVE-2020-15469 CVE-2020-15859 CVE-2020-25084 CVE-2020-28916 CVE-2020-29130...

[SECURITY] [DSA 4855-1] openssl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4855-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 17, 2021 https://www.debian.org/security/faq -...

Debian DSA-4852-1 : openvswitch - security update

Joakim Hindersson discovered that Open vSwitch, a software-based Ethernet virtual switch, allowed a malicious user to cause a denial-of-service by sending a specially crafted packet. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Debian DLA-2559-1 : busybox security update

Busybox, utility programs for small and embedded systems, was affected by several security vulnerabilities. The Common Vulnerabilities and Exposures project identifies the following issues. CVE-2011-5325 A path traversal vulnerability was found in Busybox implementation of tar. tar will extract a...

[SECURITY] [DLA 2556-1] unbound1.9 security update

Debian LTS Advisory DLA-2556-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany February 12, 2021 https://wiki.debian.org/LTS Package : unbound1.9 Version : 1.9.0-2+deb10u2deb9u1 CVE ID : CVE-2020-12662 CVE-2020-12663 CVE-2020-28935 Debian Bug : 977165 Several...