UBUNTU-CVE-2021-4008

A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcRenderCompositeGlyphs function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

UBUNTU-CVE-2021-4010

A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcScreenSaverSuspend function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

UBUNTU-CVE-2021-4009

A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcXFixesCreatePointerBarrier function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

SUSE SLED15 / SLES15 Security Update : python-pip (SUSE-SU-2021:4002-1)

The remote SUSE Linux SLED15 / SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2021:4002-1 advisory. - CVE-2021-3572: Fixed incorrect handling of unicode separators in git references bsc1186819. Tenable has extracted the preceding description...

Chainlink's latestRoundData might return stale or incorrect results

Handle WatchPug Vulnerability details function sync public , int256 feedPrice, , uint256 timestamp, = feed.latestRoundData; Fixed18 price = Fixed18Lib.ratiofeedPrice, SafeCast.toInt256decimalOffset; if priceAtVersion.length == 0 || timestamp timestampAtVersioncurrentVersion + minDelay...

SUSE SLED15 / SLES15 Security Update : python-pip (SUSE-SU-2021:4001-1)

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:4001-1 advisory. - CVE-2021-3572: Fixed incorrect handling of unicode separators in git references bsc1186819. Tenable has extracted the preceding description...

SHOULD CHECK RETURN DATA FROM CHAINLINK AGGREGATORS

Handle defsec Vulnerability details Impact The sync function in the contract ChainlinkOracle.sol fetches the asset price from a Chainlink aggregator using the latestRoundData function. However, there are no checks on roundID, resulting in stale prices. The oracle wrapper calls out to a chainlink...

Medium: vim

Issue Overview: Buffer Overflow vulnerability in VIM v.8.1.2135 allows a remote attacker to execute arbitrary code via the operand parameter. CVE-2020-20703 A flaw was found in vim. A possible heap-based buffer overflow could allow an attacker to input a specially crafted file leading to a crash ...

Oracle Linux 8 : python39:3.9 / and / python39-devel:3.9 (ELSA-2021-4160)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4160 advisory. - Security fix for CVE-2021-28957 Resolves: rhbz1941534 - Fixes CVE-2020-27783 and another vulnerability in the HTML Cleaner - Fix for CVE-2021-33503...

django: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses

A flaw was found in django. Leading zeros in octal literals aren't prohibited in IP addresses. If you used such values you could suffer from indeterminate SSRF, RFI, and LFI attacks. The highest threat from this vulnerability is to data integrity...

GHSA-76QM-4F93-FG6F Improper Input Validation in xdLocalStorage

An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage function in xdLocalStorage.js does not implement any validation of the origin of web messages. Remote attackers who can entice a user to load a malicious site can exploit this issue to impact the confidentiality and...

Improper Input Validation in xdLocalStorage

An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage function in xdLocalStoragePostMessageApi.js does not implement any validation of the origin of web messages. Remote attackers who can entice a user to load a malicious site can exploit this issue to impact the...

PT-2021-8087 · Heimdal +7 · Heimdal +7

Name of the Vulnerable Software and Affected Versions: Heimdal versions prior to 7.7.1 Description: The issue is related to an invalid free in the ASN.1 codec used by the Key Distribution Center KDC, which can be exploited by remote attackers to execute arbitrary code. This can also lead to...

The vulnerability of the serviceattrreq and processrequest functions (sdpd-request.c) in the Bluetooth protocol stack for the Linux BlueZ operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the serviceattrreq and processrequest functions sdpd-request.c in the Bluetooth protocol stack for the Linux BlueZ operating system arises from writing beyond buffer boundaries. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality,...

rpm: Signature checks bypass via corrupted rpm package

A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from th...

The vulnerability in the web interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, and Cisco Unified Communications Manager IM & Presence Service allows a perpetrator to compromise the integrity of the protected information.

The vulnerability of the Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, and Cisco Unified Communications Manager IM & Presence Service web interfaces is related to the manipulation of inter-site requests. Exploiting this vulnerability allows...

CVE-2021-39135

A flaw was found in nodejs-arborist. Arborist could write package dependencies to any arbitrary location on the file system if an attacker had replaced a project folder with a symbolic link in the nodemodules folder. The highest threat from this vulnerability is to data integrity and system...

XStream: remote command execution attack by manipulating the processed input stream

A flaw was found in XStream. By manipulating the processed input stream, a remote attacker may be able to obtain sufficient rights to execute commands. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet

A flaw was found in golang. Extraneous zero characters at the beginning of an IP address octet are not properly considered which could allow an attacker to bypass IP-based access controls. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

SUSE SLES11 Security Update : OpenEXR (SUSE-SU-2021:14846-1)

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14846-1 advisory. - CVE-2021-20298: Fixed out-of-memory in B44Compressor bsc1188460. - CVE-2021-20300: Fixed integer-overflow in Imf25:hufUncompress bsc1188458....