PYSEC-2021-1

A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the nolog feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. The highest threat from this vulnerability...

OSV-2021-703 Container-overflow in unsigned long jsoncons::detail::escape_string<char, jsoncons::string_sink<std::_

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33781 Crash type: Container-overflow READ 1 Crash state: unsigned long jsoncons::detail::escapestring::key...

Zoom deepfaker fools politicians…twice

We recently said deepfakes “remain the weapon of choice for malign interference campaigns, troll farms, revenge porn, and occasionally humorous celebrity face-swaps”. Skepticism that these techniques would work on a grand scale such as an election, remains in place. In the realm of malign...

PT-2021-30915

Уязвимость среды выполнения Visual Basic Runtime программных продуктов Yokogawa связана с ошибками управления привилегиями. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код...

CVE-2021-29467: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Wrongthink is an encrypted peer-to-peer chat program. A user could check their fingerprint into the service and enter a script to run arbitrary JavaScript on the site. No workarounds exist, but a patch exists in version 2.4.1...

SUSE: Security Advisory (SUSE-SU-2019:2089-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Schneider Electric SoMachine Basic

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: SoMachine Basic Vulnerability: Improper Restriction of XML External Entity Reference 2. RISK EVALUATION Successful exploitation of this vulnerability may result in...

CVE-2021-1420: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

A vulnerability in certain web pages of Cisco Webex Meetings could allow an unauthenticated, remote attacker to modify a web page in the context of a user's browser. The vulnerability is due to improper checks on parameter values in affected pages. An attacker could exploit this vulnerability by...

Experts uncover a new Banking Trojan targeting Latin American users

Researchers on Tuesday revealed details of a new banking trojan targeting corporate users in Brazil at least since 2019 across various sectors such as engineering, healthcare, retail, manufacturing, finance, transportation, and government. Dubbed "Janeleiro" by Slovak cybersecurity firm ESET, the...

CVE-2019-10225

A flaw was found in atomic-openshift of openshift-4.2 where the basic-user RABC role in OpenShift Container Platform doesn't sufficiently protect the GlusterFS StorageClass against leaking of the restuserkey. An attacker with basic-user permissions is able to obtain the value of restuserkey, and...

Design/Logic Flaw

A flaw was found in atomic-openshift of openshift-4.2 where the basic-user RABC role in OpenShift Container Platform doesn't sufficiently protect the GlusterFS StorageClass against leaking of the restuserkey. An attacker with basic-user permissions is able to obtain the value of restuserkey, and...

CVE-2019-10225

CVE-2019-10225 relates to a flaw in atomic-openshift (OpenShift 4.2) where the basic-user RBAC role does not sufficiently protect the GlusterFS StorageClass against leaking the restuserkey. An attacker with basic-user privileges could obtain the restuserkey and authenticate to the GlusterFS REST ...

PT-2021-3601

Name of the Vulnerable Software and Affected Versions Ansible Engine versions prior to 2.10.6rc1 Ansible Engine versions prior to 2.9.18rc1 Ansible Engine versions prior to 2.8.19rc1 Description A flaw was found in the Ansible Engine, where sensitive information is not masked by default and is no...

CVE-2021-21488

Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deserialize user-controlled data without verification, leading to insecure deserialization which triggers the attacker’s code, therefore impacting Availability...

CVE-2021-21335

In the SPNEGO HTTP Authentication Module for nginx spnego-http-auth-nginx-module before version 1.1.1 basic Authentication can be bypassed using a malformed username. This affects users of spnego-http-auth-nginx-module that have enabled basic authentication. This is fixed in version 1.1.1 of...

Authentication flaw

In the SPNEGO HTTP Authentication Module for nginx spnego-http-auth-nginx-module before version 1.1.1 basic Authentication can be bypassed using a malformed username. This affects users of spnego-http-auth-nginx-module that have enabled basic authentication. This is fixed in version 1.1.1 of...

CVE-2021-21335

In the SPNEGO HTTP Authentication Module for nginx spnego-http-auth-nginx-module before version 1.1.1 basic Authentication can be bypassed using a malformed username. This affects users of spnego-http-auth-nginx-module that have enabled basic authentication. This is fixed in version 1.1.1 of...

CVE-2021-21335 Basic Authentication can be bypassed using a malformed username

In the SPNEGO HTTP Authentication Module for nginx spnego-http-auth-nginx-module before version 1.1.1 basic Authentication can be bypassed using a malformed username. This affects users of spnego-http-auth-nginx-module that have enabled basic authentication. This is fixed in version 1.1.1 of...

CVE-2021-21335

In the SPNEGO HTTP Authentication Module for nginx spnego-http-auth-nginx-module before version 1.1.1 basic Authentication can be bypassed using a malformed username. This affects users of spnego-http-auth-nginx-module that have enabled basic authentication. This is fixed in version 1.1.1 of...

PT-2021-14429

Name of the Vulnerable Software and Affected Versions spnego-http-auth-nginx-module versions prior to 1.1.1 Description The issue allows basic authentication to be bypassed using a malformed username. This affects users who have enabled basic authentication. Recommendations For versions prior to...