UBUNTU-CVE-2021-39150

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. ...

AZL-7253 CVE-2021-37714 affecting package jsoup 1.11.3-3

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until...

OPENSUSE-SU-2021:1162-1 Security update for SUSE Manager Client Tools

This update fixes the following issues: ansible: - The support level for ansible is l2, not l3 dracut-saltboot: - Force installation of libexpat.so.1 bsc1188846 - Use kernel parameters from PXE formula also for local boot golang-github-prometheus-prometheus: - Provide and reload firewalld...

SQL Injection

Overview s-cart/core is a free Laravel e-commerce for business. Affected versions of this package are vulnerable to SQL Injection via the keyword parameter in /scadmin/currency. Remediation Upgrade s-cart/core to version 6.3.0.3 or higher. References - GitHub Additional Information - GitHub Commi...

PT-2021-6516 · Exiv2 +4 · Exiv2 +4

Name of the Vulnerable Software and Affected Versions: Exiv2 versions v0.27.4 and earlier Description: The issue is related to a lack of division by zero check in the Exiv2 library, which can cause a denial of service when a specially crafted image file is used. An attacker could exploit this to...

CVE-2021-26999

NetApp Cloud Manager versions prior to 3.9.9 log sensitive information when an Active Directory connection fails. The logged information is available only to authenticated users. Customers with auto-upgrade enabled should already be on a fixed version while customers using on-prem connectors with...

PT-2021-6778 · Curl +7 · Curl +7

Name of the Vulnerable Software and Affected Versions: curl versions prior to 7.77.0 Description: The issue is related to insufficient protection of registration data, allowing a remote attacker to access confidential data. When curl is instructed to get content using the metalink feature and a...

SQL Injection

Overview pimcore/pimcore is a content & product management framework CMS/PIM/E-Commerce. Affected versions of this package are vulnerable to SQL Injection. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within t...

PT-2021-19867 · Ory · Ory Oathkeeper

Name of the Vulnerable Software and Affected Versions: ORY Oathkeeper versions prior to v0.38.12-beta.1 Description: The issue arises when a request is made to an endpoint requiring a specific scope, and the access token is granted with that scope, making introspection valid and caching the token...

PT-2021-14712 · Jenkins · Jenkins Generic Webhook Trigger Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Generic Webhook Trigger Plugin versions 1.72 and earlier Description: The issue allows attackers to have Jenkins parse a crafted XML request body that uses external entities for extraction of secrets from the Jenkins controller or...

OESA-2021-1203 rubygem-puma security update

A simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications. Security Fixes: Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accept...

Arbitrary Code Execution

Overview Affected versions of this package are vulnerable to Arbitrary Code Execution via a crafted URL when the verifyurl option is disabled. This happens due to mishandling of the ImageMagick convert utility. NOTE: This vulnerability has also been identified as: CVE-2021-33564 Remediation Upgra...

Information Exposure

Overview foremanansible is an Ansible integration with Foreman. Affected versions of this package are vulnerable to Information Exposure. A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allows a malicious...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack. A timing issue within the EC math library can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures. Remediation...

Open Redirect

Overview Flask-Unchained is a The quickest and easiest way to build large web apps and APIs with Flask and SQLAlchemy Affected versions of this package are vulnerable to Open Redirect. When using the the validateredirecturl function, it is possible to bypass URL validation and redirect a user to ...

PT-2021-18341 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2 and earlier TensorFlow versions 2.3.3 and earlier TensorFlow versions 2.2.3 and earlier TensorFlow versions 2.1.4 and earlier Description: The implementations of the Minimum and...

PT-2021-18348 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2, 2.3.3, 2.2.3, and 2.1.4 are also affected Description: The implementation of the SpaceToBatchNd TFLite operator is vulnerable to a division by zero error. An attacker can craft a...

DEBIAN-CVE-2021-29499

SIF is an open source implementation of the Singularity Container Image Format. The siftool new command and func siftool.New produce predictable UUID identifiers due to insecure randomness in the version of the github.com/satori/go.uuid module used as a dependency. A patch is available in version...

Information Exposure

Overview pgsync is a Sync Postgres data between databases. Affected versions of this package are vulnerable to Information Exposure due to mishandling of schema syncing using the --schema-first and --schema-only flags, which may result in dropping security parameters. Remediation Upgrade pgsync t...

PT-2021-4103 · Impacket · Impacket

Name of the Vulnerable Software and Affected Versions: Impacket versions 0.9.22 and earlier Description: The issue is related to multiple path traversal vulnerabilities in the smbserver.py component of Impacket. An attacker connecting to a running smbserver instance can exploit these...