Fix a use-after-free bug in diesels Sqlite backend

We've misused sqlite3columnname. The SQLite documentation states that the following: The returned string pointer is valid until either the prepared statement is destroyed by sqlite3finalize or until the statement is automatically reprepared by the first call to sqlite3step for a particular run or...

Code injection

PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code...

Updated kernel-linus packages fix security vulnerabilities

This kernel-linus update is based on upstream 5.10.19 and fixes at least the following security issues: There is a vulnerability in the linux kernel versions higher than 5.2 if kernel compiled with config params CONFIGBPFSYSCALL=y, CONFIGBPF=y, CONFIGCGROUPS=y, CONFIGCGROUPBPF=y,...

Updated kernel packages fix security vulnerabilities

This kernel update is based on upstream 5.10.19 and fixes at least the following security issues: An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel. A userland application can read the contents of the sigpage, which can leak kernel memory contents. An...

Linux: netback fails to honor grant mapping errors

ISSUE DESCRIPTION XSA-362 tried to address issues here, but in the case of the netback driver the changes were insufficient: It left the relevant function invocation with, effectively, no error handling at all. As a result, memory allocation failures there could still lead to frontend-induced...

PT-2021-11001

Name of the Vulnerable Software and Affected Versions: ForkCMS versions prior to 5.8.3 Description: The issue allows an authenticated remote user to execute malicious code due to PHP object injection in the Ajax endpoint of the backend. Recommendations: For versions prior to 5.8.3, update to...

Authorization Bypass

fastify-reply-from is vulnerable to authorization bypass. An attacker is able to escape the prefix of the proxied backend service and access restricted service such as the parent of the base URL...

Prefix escape

Overview In fastify-http-proxy before version 4.3.1, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is...

GHSA-C4QR-GMR9-V23W Prefix escape

Impact By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N...

Remote code execution

Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the pretty option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was...

GHSA-QMW8-3V4G-GWJ4 Prefix escape

Impact By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N...

CVE-2021-21353 Remote code execution in pug

Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the pretty option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was...

CVE-2021-26855

Microsoft Exchange Server Remote Code Execution Vulnerability Recent assessments: wvu-r7 at March 09, 2021 7:01am UTC reported: CVE-2021-26855 CVE-2021-26855 is an SSRF vulnerability in Exchange that allows privileged access to Exchange’s backend resources, ultimately leading to pre-auth RCE when...

The vulnerability of Microsoft Exchange Server servers, related to insufficient validation of incoming requests, allows attackers to execute SSRF attacks.

The vulnerability of Microsoft Exchange Server lies in the insufficient checking of incoming requests. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack using specially crafted HTTPS requests that contain malicious cookie files named X-AnonResource-Backend and...

CVE-2021-21322

fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessin...

Arbitrary file download vulnerability in ZengCMS 1.0.0 backend

ZengCMS is a backend management system based on the latest TP6.0.x framework and Layui 2.5.x. ZengCMS1.0.0 backend has an arbitrary file download vulnerability, which can be exploited by attackers to obtain sensitive information...

Weak Password Vulnerability in XR20-GM of Hangzhou Dipu Technology Co.

XR20-GM is a new-generation router product based on the multi-core processor architecture of DIPTECH, which realizes the seamless integration of routing and switching with security and application delivery. The XR20-GM has a weak password vulnerability that can be exploited by attackers to log in...

PT-2021-14419

Name of the Vulnerable Software and Affected Versions fastify-http-proxy versions prior to 4.3.1 Description The issue allows an attacker to escape the prefix of the proxied backend service by crafting a specific URL. For example, if the base URL of the proxied server is /pub/, an attacker can...

Fedora 33 : xen (2021-47f53a940a)

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-47f53a940a advisory. - An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory accesses are bypassing the cache. This mea...

Fedora 33 : kernel (2021-7143aca8cb)

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-7143aca8cb advisory. - An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant...