PT-2021-7414 · Redmine · Redmine

Name of the Vulnerable Software and Affected Versions: Redmine versions 4.1.5 and earlier Redmine versions 4.2.x before 4.2.3 Description: The issue is related to an insufficient access filter, which may disclose the names of users on activity views. This allows a remote attacker to access...

KLA12265 DoS vulnerability in Mozilla Firefox

Header splitting vulnerability was found in Mozilla Firefox. Malicious users can exploit this vulnerability to cause denial of service. Original advisories MFSA2021-37 Related products Mozilla-Firefox CVE list CVE-2021-29991 unknown Solution Update to the latest version Download Firefox Impacts D...

PT-2021-21826 · Shopware · Shopware

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 6.4.3.1 Description: The issue is related to a command injection vulnerability in mail agent settings. This vulnerability affects Shopware, an open source eCommerce platform. There is no information provided about t...

OpenSSL: Timing-based attacks on SSL/TLS with CBC encryption (CVE-2003-0078) - Linux

OpenSSL is prone to timing-based attacks on SSL/TLS with CBC encryption. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fre...

OpenSSL: Multiple Vulnerabilities (20080528) - Windows

OpenSSL is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE 15 : Recommended update for seamonkey (openSUSE-SU-2021:1129-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1129-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 70300 C...

PT-2021-16303 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.26 and prior Description: The issue allows a low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks can result in unauthorized ability to cause a hang or...

PT-2021-8030 · Mitsubishi · Melsec Iq-R Series Safety Cpu Modules R08/16/32/120Sfcpu +1

Name of the Vulnerable Software and Affected Versions: MELSEC iQ-R Series Safety CPU modules R08/16/32/120SFCPU firmware versions prior to 26 MELSEC iQ-R Series SIL2 Process CPU modules R08/16/32/120PSFCPU firmware versions prior to 11 Description: The issue is related to the exposure of sensitiv...

GHSA-5FG8-2547-MR8Q Misinterpretation of malicious XML input

Impact xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications. Patches Update to one of the fixed versions of @xmldom/xmld...

D-Link DIR-3040 < 1.13B03 Hotfix Multiple Vulnerabilities - Active Check

D-Link DIR-3040 devices are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPEPREFIX = "cpe:/o:dlink"; if...

MGASA-2021-0372 Updated nodejs packages fix security vulnerabilities

This affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix: const y18n = require'y18n'; y18n.setLocale'proto'; y18n.updateLocalepolluted: true; console.logpolluted; // true CVE-2020-7774. The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Servic...

Asterisk DoS Vulnerability (AST-2021-007)

Asterisk is prone to a denial of service DoS vulnerability in the PJSIP channel driver. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2021-18840 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 14.5 iPadOS versions prior to 14.5 Description: A memory consumption issue was addressed with improved memory handling. Processing a maliciously crafted audio file may lead to arbitrary code execution. Recommendations: F...

CVE-2021-32744

Collabora Online is a collaborative online office suite. In versions prior to 4.2.17-1 and version 6.4.9-5, unauthenticated attackers are able to gain access to files which are currently opened by other users in the Collabora Online editor. For successful exploitation the attacker is required to...

CVE-2021-32744

CVE-2021-32744 affects Collabora Online. Versions prior to 4.2.17-1 and 6.4.9-5 allow unauthenticated attackers to access files open by other users by guessing the file identifier (IDOR). The file-identifier predictability depends on external storage implementations. Patches exist in 4.2.17-1 and...

Ubuntu: Security Advisory (USN-5013-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Elasticsearch 7.13.4 Security Update

Elasticsearch memory disclosure issue ESA-2021-16 A memory disclosure vulnerability was identified in Elasticsearch’s error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing...

PT-2021-3943 · Adobe · After Effects

Name of the Vulnerable Software and Affected Versions: Adobe After Effects versions 18.2.1 and earlier Description: The issue is caused by a memory corruption vulnerability when parsing a specially crafted file, allowing an unauthenticated attacker to achieve arbitrary code execution in the conte...

SUSE: Security Advisory (SUSE-SU-2021:2389-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

KLA12229 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service. Below is a complete list of vulnerabilities: 1. A memory safety vulnerability can be exploited to execute arbitrary code. 2. An out of...