linuxptp security update

CentOS Errata and Security Advisory CESA-2021:2658 An update for linuxptp is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

CentOS 7 : linuxptp (RHSA-2021:2658)

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:2658 advisory. - A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to...

CentOS 8 : linuxptp (CESA-2021:2660)

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2021:2660 advisory. - linuxptp: missing length check of forwarded messages CVE-2021-3570 Note that Nessus has not tested for this issue but has instead relied only on the...

CentOS 8 : lz4 (CESA-2021:2575)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:2575 advisory. - lz4: memory corruption due to an integer overflow bug caused by memmove argument CVE-2021-3520 Note that Nessus has not tested for this issue but has instead...

CentOS 8 : 389-ds:1.4 (CESA-2021:2595)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:2595 advisory. - 389-ds-base: syncrepl NULL pointer dereference in synccreatestatecontrol CVE-2021-3514 Note that Nessus has not tested for this issue but has instead relied...

CentOS 8 : libxml2 (CESA-2021:2569)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:2569 advisory. - libxml2: Use-after-free in xmlEncodeEntitiesInternal in entities.c CVE-2021-3516 - libxml2: Heap-based buffer overflow in xmlEncodeEntitiesInternal i...

CentOS 8 : edk2 (CESA-2021:2591)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:2591 advisory. - edk2: possible heap corruption with LzmaUefiDecompressGetInfo CVE-2021-28211 Note that Nessus has not tested for this issue but has instead relied only on the...

CentOS 8 : fwupd (CESA-2021:2566)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:2566 advisory. - grub2: acpi command allows privileged user to load crafted ACPI tables when Secure Boot is enabled CVE-2020-14372 - grub2: Use-after-free in rmmod...

CentOS 8 : kernel (CESA-2021:2570)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:2570 advisory. - kernel: security bypass in certs/blacklist.c and certs/systemkeyring.c CVE-2020-26541 - kernel: use-after-free in net/bluetooth/hcievent.c when...

CentOS 8 : rpm (CESA-2021:2574)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:2574 advisory. - rpm: Signature checks bypass via corrupted rpm package CVE-2021-20271 Note that Nessus has not tested for this issue but has instead relied only on the...

CentOS 8 : python38:3.8 and python38-devel:3.8 (CESA-2021:2583)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:2583 advisory. - PyYAML: incomplete fix for CVE-2020-1747 CVE-2020-14343 Note that Nessus has not tested for this issue but has instead relied only on the application's...

CentOS 8 : ruby:2.6 (CESA-2021:2588)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:2588 advisory. - ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? CVE-2019-15845 - ruby: Regular expression denial of service vulnerability of...

CentOS 8 : ruby:2.7 (CESA-2021:2584)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:2584 advisory. - ruby: Potential HTTP request smuggling in WEBrick CVE-2020-25613 - ruby: XML round-trip vulnerability in REXML CVE-2021-28965 Note that Nessus has no...

CentOS 8 : ruby:2.5 (CESA-2021:2587)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:2587 advisory. - ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? CVE-2019-15845 - ruby: Regular expression denial of service vulnerability of...

SAS Environment Manager 2.5 - (name) Stored Cross-Site Scripting Vulnerability

Exploit Title: SAS Environment Manager 2.5 - 'name' Stored Cross-Site Scripting XSS Exploit Author: Luqman Hakim Zahari @ Saitamang Vendor Homepage: https://support.sas.com/en/software/environment-manager-support.html Version: 2.5 Tested on: CentOS 7 CVE : CVE-2021-35475 Description SAS®...

The vulnerability of the CentOS Web Panel application management application lies in its lack of protection for website structure elements, allowing attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the CentOS Web Panel administration application is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

Wormable DarkRadiation Ransomware Targets Linux and Docker Instances

Cybersecurity researchers are sounding the alarm bell over a new ransomware strain called "DarkRadiation" that's implemented entirely in Bash and targets Linux and Docker cloud containers, while banking on messaging service Telegram for command-and-control C2 communications. "The ransomware is...

CentOS Web Panel SQL Injection (CVE-2021-31316; CVE-2021-31324)

An SQL injection vulnerability exists in CentOS Web Panel. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

Unified Office Total Connect Now 1.0 SQL Injection

Exploit Title: Unified Office Total Connect Now 1.0 – 'data' SQL Injection Shodan Filter: http.title:"TCN User Dashboard" Date: 06-16-2021 Exploit Author: Ajaikumar Nadar Vendor Homepage: https://unifiedoffice.com/ Software Link: https://unifiedoffice.com/voip-business-solutions/ Version: 1.0...

Unified Office Total Connect Now 1.0 - (data) SQL Injection Vulnerability

Exploit Title: Unified Office Total Connect Now 1.0 – 'data' SQL Injection Shodan Filter: http.title:"TCN User Dashboard" Exploit Author: Ajaikumar Nadar Vendor Homepage: https://unifiedoffice.com/ Software Link: https://unifiedoffice.com/voip-business-solutions/ Version: 1.0 Tested on: CentOS +...