CVE-2021-35576

CVE-2021-35576 is a vulnerability in Oracle Database Server's Unified Audit component affecting 12.1.0.2, 12.2.0.1 and 19c. It allows a high-privileged attacker with Local Logon and network access via Oracle Net to compromise the Unified Audit data, potentially enabling unauthorized update/insert...

Security update for ssh-audit (moderate)

openSUSE Security Update: Security update for ssh-audit Announcement ID: openSUSE-SU-2021:1390-1 Rating: moderate References: Cross-References: CVE-2018-15473 CVSS scores: CVE-2018-15473 NVD : 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2018-15473 SUSE: 5.8...

Oracle Database Server has an unspecified vulnerability (CNVD-2021-84599)

Oracle Database Server is a relational database management system from Oracle Corporation USA. An unspecified vulnerability exists in the Oracle Database Enterprise Edition Unified Audit component of Oracle Database Server versions 12.1.0.2, 12.2.0.1, and 19c. An attacker could use this...

CVE-2021-35576

Vulnerability in the Oracle Database Enterprise Edition Unified Audit component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Easily exploitable vulnerability allows high privileged attacker having Local Logon privilege with network access via...

PT-2021-20986 · Oracle · Oracle Database Enterprise Edition Unified Audit +1

Name of the Vulnerable Software and Affected Versions: Oracle Database Enterprise Edition Unified Audit versions 12.1.0.2, 12.2.0.1 and 19c Description: The issue affects the Oracle Database Enterprise Edition Unified Audit component of Oracle Database Server, allowing a high-privileged attacker...

openSUSE 15 Security Update : ssh-audit (openSUSE-SU-2021:1383-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2021:1383-1 advisory. - OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the...

Oracle Database Server 输入验证错误漏洞

Oracle Database Server is a relational database management system from Oracle Corporation USA. An unspecified vulnerability exists in the Oracle Database Enterprise Edition Unified Audit component of Oracle Database Server versions 12.1.0.2, 12.2.0.1, and 19c. An attacker could use this...

openSUSE: Security Advisory for ssh-audit (openSUSE-SU-2021:1383-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2021:1383-1 Security update for ssh-audit

This update for ssh-audit fixes the following issues: ssh-audit was updated to version 2.5.0 Fixed crash when running host key tests. Handles server connection failures more gracefully. Now prints JSON with indents when -jj is used useful for debugging. Added MD5 fingerprints to verbose output...

Security update for ssh-audit (moderate)

openSUSE Security Update: Security update for ssh-audit Announcement ID: openSUSE-SU-2021:1383-1 Rating: moderate References: Cross-References: CVE-2018-15473 CVSS scores: CVE-2018-15473 NVD : 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2018-15473 SUSE: 5.8...

CVE-2021-3882

LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy. By tricking a user to use an unencrypted connection HTTP, an attacker may be able to obtain the authentication data by capturing network...

Authentication flaw

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user can modify the contents of a confirmationtoken input during the two-factor authentication process to reference a cache value not associated with the login attempt. In rare cases this can...

Missing event & timelock for critical onlyAdmin functions

Handle 0xRajeev Vulnerability details Impact onlyAdmin functions that change critical contract parameters/addresses/state should emit events and consider adding timelocks so that users and other privileged roles can detect upcoming changes by offchain monitoring of events and have the time to rea...

Swivel.sol transfer of tokens in initiateZcTokenFillingZcTokenExit and initiateVaultFillingVaultExit can fail without reverting causing account problems

Handle GalloDaSballo Vulnerability details Impact initiateZcTokenFillingZcTokenExit and initiateVaultFillingVaultExit in Swivel.sol are using transferFrom This function call can fail meaning the tokens are not transferred without causing a revert This would break the accounting in the protocol I...

GHSA-5VFX-8W6M-H3V4 Pterodactyl Panel vulnerable to authentication bypass due to improper user-provided security token verification

A malicious user can modify the contents of a confirmationtoken input during the two-factor authentication process to reference a cache value not associated with the login attempt. In rare cases this can allow a malicious actor to authenticate as a random user in the Panel. The malicious user mus...

Pterodactyl Panel vulnerable to authentication bypass due to improper user-provided security token verification

A malicious user can modify the contents of a confirmationtoken input during the two-factor authentication process to reference a cache value not associated with the login attempt. In rare cases this can allow a malicious actor to authenticate as a random user in the Panel. The malicious user mus...

PT-2021-23112 · Unknown · Pterodactyl

Name of the Vulnerable Software and Affected Versions: Pterodactyl affected versions not specified Description: A malicious user can modify the contents of a confirmation token input during the two-factor authentication process to reference a cache value not associated with the login attempt. Thi...

Imperva Cloud Data Security adds Azure SQL support to build on extensive DBaaS coverage

It’s kind of mind boggling to see just how fast the market is adopting cloud managed database services also referred to as DBaaS. According to market research firm Imarc Group, In 2020, the overall market size was $12.8 billion, and within five years it’s expected to reach over $31 billion. That’...

Improper Privilege Management in openemr/openemr

Description A predefined Front desk receptionist have access to the Audit Log Tamper Report function. By default this is a predefined system administrator function, and no other users should be able to access this function. Proof of Concept Log in with a Front desk receptionist user Simply open t...

Security Bulletin: IBM Cloud Pak for Data could allow a local user with special privileges to obtain highly sensitive information

Summary Cloud Pak for Data "shared credentials" are available to authorized users. However, because the credentials are shared, it is difficult to audit access to the connection, to identify the source of data loss, or identify the source of a security breach. You can apply a patch to disable thi...