ALBA-2021:3578 pacemaker bug fix and enhancement update

The Pacemaker cluster resource manager is a collection of technologies working together to maintain data integrity and application availability in the event of failures. Bug Fixes and Enhancements: pacemaker seems to end up in an unfence loop BZ1972273 On a three-node cluster if two nodes are...

pacemaker bug fix and enhancement update

An update is available for pacemaker. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Pacemaker cluster resource manager is a collection of technologies...

pacemaker bug fix and enhancement update

The Pacemaker cluster resource manager is a collection of technologies working together to maintain data integrity and application availability in the event of failures. Bug Fixes and Enhancements: pacemaker seems to end up in an unfence loop BZ1972273 On a three-node cluster if two nodes are...

CVE-2020-16630

TI’s BLE stack caches and reuses the LTK’s property for a bonded mobile. A LTK can be an unauthenticated-and-no-MITM-protection key created by Just Works or an authenticated-and-MITM-protection key created by Passkey Entry, Numeric Comparison or OOB. Assume that a victim mobile uses secure pairin...

CVE-2021-24525

The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via shortcode attributes. Note: the plugin is inconsistent in its handling of shortcode attributes; some do escape, most don't, and there are even some attributes that are insecure by...

CVE-2021-24525 Shortcodes Ultimate < 5.10.2 - Contributor+ Stored XSS

The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via shortcode attributes. Note: the plugin is inconsistent in its handling of shortcode attributes; some do escape, most don't, and there are even some attributes that are insecure by...

WordPress to Hootsuite (< 1.3.9) & Buffer (< 3.7.5) - Reflected Cross-Site Scripting

The plugins do not properly sanitise and escape user input before outputting it back in pages and attributes, which could lead to reflected Cross-Site Scripting issues PoC https://example.com/wp-admin/admin.php?page=wp-to-buffer-log=...

Flickr: Flickr Account Takeover using AWS Cognito API

Flickr uses Amazon Cognito to implement its login functionality. Furthermore, Flickr does not allow users to change their registered e-mail address via the user interface. This restriction can be bypassed via direct communication with the Amazon Cognito User Pool API. Consider we have the followi...

Jitsi Meet 跨站脚本漏洞

Jitsi Meet is is a set of open source projects. Enabling users to use and deploy a video conferencing platform with state-of-the-art video quality and features. A cross-site scripting vulnerability exists in versions prior to Jitsi Meet 2.0.6173, which stems from software that injects attributes...

The vulnerability of the `get_portfolios()` and `get_portfolio_attributes()` functions in the Portfolio Responsive Gallery plugin of the WordPress content management system allows a hacker to execute arbitrary SQL code.

The vulnerability of the getportfolios and getportfolioattributes functions in the Portfolio Responsive Gallery plugin of the WordPress content management system is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability could allow a remote attacker ...

GHSA-CQQH-49MX-FQ63 merge vulnerable to Prototype Pollution

merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

CVE-2021-3666

body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

CVE-2021-3666

body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

wildfly-core: Invalid Sensitivity Classification of Vault Expression

A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly...

GHSA-C36V-FMGQ-M8HX Prototype Pollution in immer

immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

CVE-2021-33287

In NTFS-3G versions 2021.8.22, when specially crafted NTFS attributes are read in the function ntfsattrpreadi, a heap buffer overflow can occur and allow for writing to arbitrary memory or denial of service of the application...

AZL-6750 CVE-2021-33287 affecting package ntfs-3g for versions less than 2021.8.22-1

In NTFS-3G versions 2021.8.22, when specially crafted NTFS attributes are read in the function ntfsattrpreadi, a heap buffer overflow can occur and allow for writing to arbitrary memory or denial of service of the application...

DEBIAN-CVE-2021-33287

In NTFS-3G versions 2021.8.22, when specially crafted NTFS attributes are read in the function ntfsattrpreadi, a heap buffer overflow can occur and allow for writing to arbitrary memory or denial of service of the application...

CVE-2021-33287

In NTFS-3G versions 2021.8.22, when specially crafted NTFS attributes are read in the function ntfsattrpreadi, a heap buffer overflow can occur and allow for writing to arbitrary memory or denial of service of the application...

UBUNTU-CVE-2021-33287

In NTFS-3G versions 2021.8.22, when specially crafted NTFS attributes are read in the function ntfsattrpreadi, a heap buffer overflow can occur and allow for writing to arbitrary memory or denial of service of the application...