October 12, 2021-KB5005539 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 10, version 2004, Windows Server, version 2004, Windows 10, version 20H2, Windows Server, version 20H2, and Windows Version 21H1

None None...

October 12, 2021-KB5005538 Cumulative Update for .NET Framework 3.5 and 4.8 for Microsoft server operating system version 21H2

None None...

SUSE SLES15: MozillaFirefox / MozillaFirefox-branding-SLE / MozillaFirefox-devel / etc (SUSE-SU-2021:3331-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3331-1 advisory. This update contains the Firefox Extended Support Release 91.2.0 ESR. Firefox Extended Support Release 91.2.0 ESR Fixed: Various...

Security update for chromium (important)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2021:1350-1 Rating: important References: 1190765 1191166 1191204 1191463 Cross-References: CVE-2021-37956 CVE-2021-37957 CVE-2021-37958 CVE-2021-37959 CVE-2021-37960 CVE-2021-37961 CVE-2021-37962 CVE-2021-37963...

Chromium: CVE-2021-37977 Use after free in Garbage Collection

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Microsoft Edge (Chromium) < 94.0.992.47 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 94.0.992.47. It is, therefore, affected by multiple vulnerabilities as referenced in the October 11, 2021 advisory. - heap buffer overflow in WebRTC in Google Chrome prior to 94.0.4606.81 allowed a remote attacker who...

KLA12307 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service. Below is a complete list of vulnerabilities: 1. An use after free in Garbage Collection can be exploited to cause denial of service or...

FreeBSD : chromium -- multiple vulnerabilities (7d3d94d3-2810-11ec-9c51-3065ec8fd3ec)

Chrome Releases reports : This release contains 4 security fixes, including : - 1252878 High CVE-2021-37977: Use after free in Garbage Collection. Reported by Anonymous on 2021-09-24 - 1236318 High CVE-2021-37978: Heap buffer overflow in Blink. Reported by Yangkang @dnpushme of 360 ATA on...

Google Chrome Post-release Reuse Vulnerability (CNVD-2021-84819)

Chrome is a web browsing tool developed by Google. A post-release reuse vulnerability exists in Garbage Collection in versions of Google Chrome prior to 94.0.4606.81. An attacker could exploit this vulnerability to potentially exploit heap corruption via a crafted HTML page...

Survey Solutions Information Breach Vulnerability

Survey Solutions is a survey management and data collection system. survey Solutions is vulnerable to an information disclosure vulnerability that stems from a configuration or other error in the operation of the network system or product. An attacker could exploit the vulnerability to obtain...

Google Chrome < 94.0.4606.81 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 94.0.4606.81. It is, therefore, affected by multiple vulnerabilities as referenced in the 202110stable-channel-update-for-desktop advisory. - heap buffer overflow in WebRTC in Google Chrome prior to 94.0.4606.81 allowed a...

Google Chrome 资源管理错误漏洞

Chrome is a web browsing tool developed by Google. A post-release reuse vulnerability exists in Garbage Collection in versions of Google Chrome prior to 94.0.4606.81. An attacker could exploit this vulnerability to potentially exploit heap corruption via a crafted HTML page...

CVE-2021-41123

Survey Solutions is a survey management and data collection system. In affected versions the Headquarters application publishes /metrics endpoint available to any user. None of the survey answers are ever exposed, only the aggregate counters, including count of interviews, or count of assignments...

CVE-2021-41123

Survey Solutions is a survey management and data collection system. In affected versions the Headquarters application publishes /metrics endpoint available to any user. None of the survey answers are ever exposed, only the aggregate counters, including count of interviews, or count of assignments...

Default credentials

Survey Solutions is a survey management and data collection system. In affected versions the Headquarters application publishes /metrics endpoint available to any user. None of the survey answers are ever exposed, only the aggregate counters, including count of interviews, or count of assignments...

CVE-2021-41123

CVE-2021-41123 relates to Survey Solutions where the Headquarters application exposes a public /metrics endpoint in affected releases. The vulnerability stems from an information-disclosure risk exposing only aggregate counters (e.g., interviews, assignments) rather than survey answers; there is ...

CVE-2021-41123 Exposure of Sensitive Information to an Unauthorized Actor in WB.UI.Headquarters.dll

Survey Solutions is a survey management and data collection system. In affected versions the Headquarters application publishes /metrics endpoint available to any user. None of the survey answers are ever exposed, only the aggregate counters, including count of interviews, or count of assignments...

CVE-2021-41465

Cross-site scripting XSS vulnerability in concrete/elements/collectiontheme.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter...

CVE-2021-41464

Cross-site scripting XSS vulnerability in concrete/elements/collectionadd.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter...

Mac Users Targeted by Trojanized iTerm2 App

We go into more detail about a fake version of the iTerm2 app that downloads and runs malware, detected by Trend Micro as TrojanSpy.Python.ZURU.A, which collects private data from a victim’s machine...