Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the alias field on a Chart.yaml is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review th...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the alias field on a Chart.yaml is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review th...

[SECURITY] Fedora 34 Update: python-starlette-0.14.2-6.fc34

Starlette is a lightweight ASGI framework/toolkit, which is ideal for build ing high performance asyncio services. It is production-ready, and gives you the following: Seriously impressive performance. WebSocket support. GraphQL support. In-process background tasks. Startup and shutdown events...

RHEL 8 : pki-core:10.6 and pki-deps:10.6 (RHSA-2021:1775)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1775 advisory. The Public Key Infrastructure PKI Core contains fundamental packages required by Red Hat Certificate System. Security Fixes: resteasy: Improper...

PT-2021-8193

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the drm sched entity kill jobs function in the Linux kernel, which can cause data corruptions due to a buffer overflow. This can potentially allow a remote attack...

Mediator - An Extensible, End-To-End Encrypted Reverse Shell With A Novel Approach To Its Architecture

Mediator is an end-to-end encrypted reverse shell in which the operator and the shell connect to a "mediator" server that bridges the connections. This removes the need for the operator/handler to set up port forwarding in order to listen for the connection. Mediator also allows you to create...

pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update

An update is available for jackson-core, ldapjdk, glassfish-jaxb-api, glassfish-fastinfoset, xalan-j2, apache-commons-net, xmlstreambuffer, jackson-annotations, jackson-databind, pki-servlet-engine, apache-commons-lang, jackson-module-jaxb-annotations, apache-commons-collections, tomcatjss,...

New TsuNAME Flaw Could Let Attackers Take Down Authoritative DNS Servers

Security researchers Thursday disclosed a new critical vulnerability affecting Domain Name System DNS resolvers that could be exploited by adversaries to carry out reflection-based denial-of-service attacks against authoritative nameservers. The flaw, called 'TsuNAME,' was discovered by researche...

PT-2024-11120 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the definition of the fixmap area in the Linux kernel for powerpc/64. The current definition at the top of the address space or just below KASAN is not valid fo...

openSUSE: Security Advisory for nodejs12 (openSUSE-SU-2021:0064-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

PT-2021-18215 · Grav · Grav Admin Plugin

Name of the Vulnerable Software and Affected Versions: Grav admin plugin versions prior to 1.10.11 Description: The issue arises from incorrect verification of caller's privileges, allowing users with the admin.login permission to install third-party plugins and their dependencies. This can lead ...

Client TLS credentials sent raw to server in npm package nats

Nats is a Node.js client for the NATS messaging system. Problem Description Preview versions of two NPM packages and one Deno package from the NATS project contain an information disclosure flaw, leaking options to the NATS server; for one package, this includes TLS private credentials. The...

USN-4870-1: Bundler vulnerability

It was discovered that Bundler incorrectly created directories with insecure permissions in /tmp. An attacker could write malicious libraries to this location for later execution...

USN-4858-1: Gradle vulnerabilities

It was discovered that Gradle used an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins were used. A remote unauthenticated attacker could possibly use this issue to perform a machine-in-the-middle attack. CVE-2019-11065 It was discovered that...

RubyGems: Bundler's RCE with response using Marshal

A vulnerability was found in Bundler's dependency API endpoint, which uses Marshal serialization. This could allow for remote code execution if a client receives a specially crafted response. The impact is increased risk from specifying an untrusted source or man-in-the-middle attack...

How to troubleshoot printing on Citrix Workspace app for Mac

How it all works Prerequisites and scope What is supported What is not supported External dependencies for printing Apple/HP...

Unsafe Dependency Resolution

Overview Affected versions of this package are vulnerable to Unsafe Dependency Resolution. An issue exist in bundler regarding the priority for transitive dependencies and split lockfile rubygems source sections. This could lead to a dependency confusion attack where gems are resolved incorrectly...

Supply-Chain Hack Breaches 35 Companies, Including PayPal, Microsoft, Apple

An ethical hacker has demonstrated a novel supply-chain attack that breached the systems of more than 35 technology players, including Microsoft, Apple, PayPal, Shopify, Netflix, Tesla and Uber, by exploiting public, open-source developer tools. The attack, devised by security researcher Alex...

Dependency Confusion Supply-Chain Attack Hit Over 35 High-Profile Companies

In what's a novel supply chain attack, a security researcher managed to breach over 35 major companies' internal systems, including that of Microsoft, Apple, PayPal, Shopify, Netflix, Yelp, Tesla, and Uber, and achieve remote code execution. The technique, called dependency confusion or a...

SUSE SLES12 Security Update : nodejs12 (SUSE-SU-2021:0068-1)

This update for nodejs12 fixes the following issues : New upstream LTS version 12.20.1 : - CVE-2020-8265: use-after-free in TLSWrap High bug in TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object ...