Security Update for Microsoft Visual Studio Code .NET Education Bundle SDK Install Tool Extension (July 2021)

The Microsoft Visual Studio Code .NET Education Bundle SDK Install Tool Extension is prior to version 0.7.0. It is, therefore, affected by an elevation of privilege vulnerability due to inaccurately scoped permissions being set on downloaded .NET install scripts. Note that Nessus has not tested f...

HPESBHF04182 rev.1 - HPE Superdome X Servers, Remote Denial of Service (DoS)

Potential Security Impact: Remote: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HP Superdome X Base Enclosure - Prior to Bundle 8.8.50 HPE Integrity Superdome X Server - Prior to Bundle 8.8.50 HPE Integrity Superdome X with BL920s Blades - Prior to Bundle...

Cross-site Scripting (XSS)

contao/core-bundle is vulnerable to cross site scripting. The vulnerability exists due to an insecure tllog table which will execute injected code in the browser when the system log is called in the back end...

com.zaxxer:nuprocess (>=0.9.0, <=0.9.4), com.zaxxer:sansorm (1.0) +47 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0.7)

org.apache.maven:maven-core MAVEN version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - com.zaxxer:nuprocess =0.9.0, =2.0, =1.1.0.beta5, =2.3.5, =2.2.5, =2.2.5, =1.0-beta-1, =2.1m1, =2.1m1,...

CVE-2021-3601

A flaw was found in the way OpenSSL will accept a certificate with explicitly set Basic Constraints to CA:FALSE as a valid CA if it is present in the trusted bundle. This flaw allows an attacker with access to a private key, of which the corresponding certificate is in the trust bundle, to use th...

PT-2021-24817

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.37 Description: A use after free issue was discovered in the ath10k htc send bundle function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

CVE-2021-27434

CVE-2021-27434 affects Unified Automation .NET based OPC UA Client/Server SDK Bundle (versions up to 3.0.7 on .NET Framework 4.5, 4.0, 3.5). Root cause is an uncontrolled recursion that may trigger a stack overflow. Impact, per CVSS3.1: high confidentiality impact with no functional integrity or ...

CVE-2021-27434: Exposure of Sensitive Information to an Unauthorized Actor

Products with Unified Automation .NET based OPC UA Client/Server SDK Bundle: Versions V3.0.7 and prior .NET 4.5, 4.0, and 3.5 Framework versions only are vulnerable to an uncontrolled recursion, which may allow an attacker to trigger a stack overflow...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), baluchon (0.0.1) +4 more potentially affected by CVE-2020-26759 via clickhouse-driver (>=0.1.1, <=0.1.4)

clickhouse-driver PYPI version =0.1.1, =0.5.1, =0.0.4, =2.2.0, =2.3.2 Source cves: CVE-2020-26759 Source advisory: OSV:GHSA-VGV5-CXVH-VFXH...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), baluchon (0.0.1) +4 more potentially affected by CVE-2020-26759 via clickhouse-driver (>=0.1.1, <=0.1.4)

clickhouse-driver PYPI version =0.1.1, =0.5.1, =0.0.4, =2.2.0, =2.3.2 Source cves: CVE-2020-26759 Source advisory: GHSA-VGV5-CXVH-VFXH...

PT-2021-1016

Name of the Vulnerable Software and Affected Versions: Pacemaker affected versions not specified Description: The issue concerns the Pacemaker cluster resource manager, which is designed to maintain data integrity and application availability in the event of failures. Specifically, there are...

CompTIA Security Certification Prep — Lifetime Access for just $30

At long last, top companies are starting to take cybersecurity seriously. As a consequence, technical recruiters are looking for people with hacking skills and certifications to prove it. CompTIA is seen as the gold standard when it comes to cybersecurity exams, with several certifications to...

CompTIA Security Certification Prep — Lifetime Access for just $30

At long last, top companies are starting to take cybersecurity seriously. As a consequence, technical recruiters are looking for people with hacking skills and certifications to prove it. CompTIA is seen as the gold standard when it comes to cybersecurity exams, with several certifications to...

RubyGems: Bundler's RCE with response using Marshal

A vulnerability was found in Bundler's dependency API endpoint, which uses Marshal serialization. This could allow for remote code execution if a client receives a specially crafted response. The impact is increased risk from specifying an untrusted source or man-in-the-middle attack...

CVE-2021-21621

Jenkins Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the "About user basic authentication details only" information, which can include the session ID of the user creating the support bundle in some configurations...

Jenkins Support Core information leakage vulnerability

Jenkins Support Core is a Jenkins open source application plugin . Provides in Jenkins to generate support information "bundle" of the basic infrastructure . An information disclosure vulnerability exists in Jenkins Support Core Plugin version 2.72 and earlier. The vulnerability stems from the...

CVE-2021-21621: Exposure of Sensitive Information to an Unauthorized Actor

Jenkins Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the "About user basic authentication details only" information, which can include the session ID of the user creating the support bundle in some configurations...

NetApp Clustered Data ONTAP Information Disclosure Vulnerability (CNVD-2021-12090)

NetApp Clustered Data ONTAP is NetApp's proprietary operating system for storage disk arrays. An information disclosure vulnerability exists in NetApp Clustered Data ONTAP versions prior to 9.1P18, 9.3P12. An attacker can exploit this vulnerability to discover node names via the AutoSupport bundl...

NetApp Clustered Data ONTAP Information Disclosure Vulnerability (CNVD-2021-12089)

NetApp Clustered Data ONTAP is NetApp's proprietary operating system for storage disk arrays. An information disclosure vulnerability exists in NetApp Clustered Data ONTAP versions prior to 9.3P20. An attacker can exploit this vulnerability via the AutoSupport bundle to discover node names even i...

NetApp Clustered Data ONTAP security vulnerabilities

NetApp Clustered Data ONTAP is NetApp's proprietary operating system for storage disk arrays. An information disclosure vulnerability exists in NetApp Clustered Data ONTAP versions prior to 9.1P18, 9.3P12. An attacker can exploit this vulnerability to discover node names via the AutoSupport bundl...