CVE-2021-21440 Support Bundle includes S/Mime and PGP keys

Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG OTRS Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.27 and prior versions; 8.0.x version 8.0.14 and prior versions...

Prototype Pollution

graphhopper-web-bundle is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes through URL parser and modify attributes such as proto, constructor and prototype...

CVE-2021-23408

This affects the package com.graphhopper:graphhopper-web-bundle before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or proto payload...

PT-2021-15499 · Graphhopper · Graphhopper-Web-Bundle

Name of the Vulnerable Software and Affected Versions: com.graphhopper:graphhopper-web-bundle versions prior to 3.2 com.graphhopper:graphhopper-web-bundle versions 4.0-pre1 through 4.0 Description: The issue affects the URL parser, which could be tricked into adding or modifying properties of...

CVE-2021-32770 Basic-auth app bundle credential exposure in gatsby-source-wordpress

Gatsby is a framework for building websites. The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. Users who are not initializing basic authentication credentials in the gatsby-config.js a...

Microsoft Visual Studio Code 权限许可和访问控制问题漏洞

Microsoft Visual Studio Code is an open source code editor from Microsoft Corporation USA. A vulnerability exists in Microsoft Visual Studio Code due to privilege licensing and access control issues. The following products and versions are affected: .NET Education Bundle SDK Install Tool, .NET...

Security Update for Microsoft Visual Studio Code .NET Education Bundle SDK Install Tool Extension (July 2021)

The Microsoft Visual Studio Code .NET Education Bundle SDK Install Tool Extension is prior to version 0.7.0. It is, therefore, affected by an elevation of privilege vulnerability due to inaccurately scoped permissions being set on downloaded .NET install scripts. Note that Nessus has not tested f...

HPESBHF04182 rev.1 - HPE Superdome X Servers, Remote Denial of Service (DoS)

Potential Security Impact: Remote: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HP Superdome X Base Enclosure - Prior to Bundle 8.8.50 HPE Integrity Superdome X Server - Prior to Bundle 8.8.50 HPE Integrity Superdome X with BL920s Blades - Prior to Bundle...

Cross-site Scripting (XSS)

contao/core-bundle is vulnerable to cross site scripting. The vulnerability exists due to an insecure tllog table which will execute injected code in the browser when the system log is called in the back end...

CVE-2021-3601

A flaw was found in the way OpenSSL will accept a certificate with explicitly set Basic Constraints to CA:FALSE as a valid CA if it is present in the trusted bundle. This flaw allows an attacker with access to a private key, of which the corresponding certificate is in the trust bundle, to use th...

CVE-2021-27434

CVE-2021-27434 affects Unified Automation .NET based OPC UA Client/Server SDK Bundle (versions up to 3.0.7 on .NET Framework 4.5, 4.0, 3.5). Root cause is an uncontrolled recursion that may trigger a stack overflow. Impact, per CVSS3.1: high confidentiality impact with no functional integrity or ...

CompTIA Security Certification Prep — Lifetime Access for just $30

At long last, top companies are starting to take cybersecurity seriously. As a consequence, technical recruiters are looking for people with hacking skills and certifications to prove it. CompTIA is seen as the gold standard when it comes to cybersecurity exams, with several certifications to...

CompTIA Security Certification Prep — Lifetime Access for just $30

At long last, top companies are starting to take cybersecurity seriously. As a consequence, technical recruiters are looking for people with hacking skills and certifications to prove it. CompTIA is seen as the gold standard when it comes to cybersecurity exams, with several certifications to...

RubyGems: Bundler's RCE with response using Marshal

A vulnerability was found in Bundler's dependency API endpoint, which uses Marshal serialization. This could allow for remote code execution if a client receives a specially crafted response. The impact is increased risk from specifying an untrusted source or man-in-the-middle attack...

Jenkins Support Core 信息泄露漏洞

Jenkins Support Core is a Jenkins open source application plugin . Provides in Jenkins to generate support information "bundle" of the basic infrastructure . An information disclosure vulnerability exists in Jenkins Support Core Plugin version 2.72 and earlier. The vulnerability stems from the...

NetApp Clustered Data ONTAP Information Disclosure Vulnerability (CNVD-2021-12090)

NetApp Clustered Data ONTAP is NetApp's proprietary operating system for storage disk arrays. An information disclosure vulnerability exists in NetApp Clustered Data ONTAP versions prior to 9.1P18, 9.3P12. An attacker can exploit this vulnerability to discover node names via the AutoSupport bundl...

NetApp Clustered Data ONTAP Information Disclosure Vulnerability (CNVD-2021-12089)

NetApp Clustered Data ONTAP is NetApp's proprietary operating system for storage disk arrays. An information disclosure vulnerability exists in NetApp Clustered Data ONTAP versions prior to 9.3P20. An attacker can exploit this vulnerability via the AutoSupport bundle to discover node names even i...

Netapp Clustered Data ONTAP 安全漏洞

NetApp Clustered Data ONTAP is NetApp's proprietary operating system for storage disk arrays. An information disclosure vulnerability exists in NetApp Clustered Data ONTAP versions prior to 9.1P18, 9.3P12. An attacker can exploit this vulnerability to discover node names via the AutoSupport bundl...

Ubuntu: Security Advisory (USN-4719-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : ca-certificates update (USN-4719-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4719-1 advisory. The ca-certificates package contained outdated CA certificates. This update refreshes the included certificates to those contained in the...