Design/Logic Flaw

Shopware is an open source eCommerce platform. Versions prior to 6.3.5.1 may leak of information via Store-API. The vulnerability could only be fixed by changing the API system, which involves a non-backward-compatible change. Only consumers of the Store-API should be affected by this change. We...

CVE-2021-32711 Leak of information via Store-API

Shopware is an open source eCommerce platform. Versions prior to 6.3.5.1 may leak of information via Store-API. The vulnerability could only be fixed by changing the API system, which involves a non-backward-compatible change. Only consumers of the Store-API should be affected by this change. We...

UBUNTU-CVE-2020-23319

There is an Assertion in 'flags CBCSTACKADJUSTSHIFT = CBCSTACKADJUSTBASE || CBCSTACKADJUSTBASE - flags CBCSTACKADJUSTSHIFT stackdepth' in parseremitcbcbackwardbranch in JerryScript 2.2.0...

Security update for alpine (moderate)

openSUSE Security Update: Security update for alpine Announcement ID: openSUSE-SU-2021:0695-1 Rating: moderate References: 1173281 Cross-References: CVE-2020-14929 CVSS scores: CVE-2020-14929 NVD : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2020-14929 SUSE: 7.5...

python jsonpickle 2.0.0 - Remote Code Execution

Exploit Title: python jsonpickle 2.0.0 - Remote Code Execution Date: 24-2-2021 Vendor Homepage: https://jsonpickle.github.io Exploit Author: Adi Malyanker, Shay Reuven Software Link: https://github.com/jsonpickle/jsonpickle Version: 2.0.0 Tested on: windows, linux Python is an open source languag...

Don't use functions as callbacks unless they're designed for it

Here's an old pattern that seems to be making a comeback: // Convert some numbers into human-readable strings: import toReadableNumber from 'some-library'; const readableNumbers = someNumbers.maptoReadableNumber; Where the implementation of toReadableNumber is like this: export function...

Security Bulletin: Potential vulnerability with jQuery

Summary A potential vulnerability has been identified related to jQuery. Refer to details for additional information. Vulnerability Details Third Party Entry: 180875 DESCRIPTION: jQuery cross-site scripting CVSS Base score: 6.1 CVSS Temporal Score: See:...

Authentication flaw

The Micro Air Vehicle Link MAVLink protocol presents authentication mechanisms on its version 2.0 however according to its documentation, in order to maintain backwards compatibility, GCS and autopilot negotiate the version via the AUTOPILOTVERSION message. Since this negotiation depends on the...

postgresql security update

CentOS Errata and Security Advisory CESA-2020:3284 An update for postgresql-jdbc is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

postgresql-jdbc security update

An update is available for postgresql-jdbc. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list PostgreSQL is an advanced object-relational database management syste...

The vulnerability of Thunderbolt devices’ microcontrollers, related to errors in the implementation of backward compatibility mechanisms, allows attackers to gain direct access to the memory of computing devices to which Thunderbolt-enabled devices are connected.

The vulnerability of Thunderbolt device microcontrollers is related to errors in the implementation of backward compatibility mechanisms. Exploiting this vulnerability can allow an attacker to gain direct access to the memory of computing devices, to which Thunderbolt-enabled devices are connecte...

[SECURITY] Fedora 31 Update: perl-Email-MIME-ContentType-1.024-1.fc31

This module is responsible for parsing email content type headers according to section 5.1 of RFC 2045. It returns a hash with entries for the type, the subtype, and a hash of attributes. For backward compatibility with a really unfortunate misunderstanding of RFC 2045 by the early implementors o...

[SECURITY] Fedora 32 Update: perl-Email-MIME-ContentType-1.024-1.fc32

This module is responsible for parsing email content type headers according to section 5.1 of RFC 2045. It returns a hash with entries for the type, the subtype, and a hash of attributes. For backward compatibility with a really unfortunate misunderstanding of RFC 2045 by the early implementors o...

CVE-2017-18342

In PyYAML before 5.1, the yaml.load API could execute arbitrary code if used with untrusted data. The load function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function...

5G Security

The security risks inherent in Chinese-made 5G networking equipment are easy to understand. Because the companies that make the equipment are subservient to the Chinese government, they could be forced to include backdoors in the hardware or software to give Beijing remote access. Eavesdropping i...

Veeam Availability Console 3.0 RESTful API backward compatibility

Challenge This article describes improved Veeam Availability Console v3 RESTful API functionality that may retrieve different data compared to previous versions. Cause /Jobs: LastRun or EndTime now returns 00:00:00.0000000 UTC, January 1, 0001 if the value is not populated in UI /HardwarePlans:...

Fedora 29 : mongo-c-driver (2018-2f8f5f75f1)

libbson 1.13.0 Features: - New functions to save and restore progress of a bsonitert: bsoniterkeylen, bsoniteroffset, and soniterinitfromdataatoffset Additional functions bsoniteroverwritedatetime, bsoniteroverwriteoid, and bsoniteroverwritetimestamp. All fixed-length BSON values can now be updat...

Fedora 28 : singularity (2018-da87b1e643)

This rebases singularity from 2.2.1 to 2.5.1, which should include all corresponding updates n.b. a request for rebase permission has been put into FESCo; hence auto-push has been disabled until they approve. Please test for functionality and backward compatibility issues, particularly around the...

QEMU Null Pointer Backward Reference Vulnerability

QEMU aka Quick Emulator is a set of simulation processor software developed by French programmer Fabrice Bellard. The software is fast and cross-platform. A null pointer reverse-reference vulnerability exists in QEMU, which stems from the program's failure to specify a routine to handle the...

ALPINE-CVE-2017-2615

Quick emulator QEMU built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or...