Unspecified Vulnerability in Bundler

Bundler is a software application. It provides a consistent environment for Ruby projects by tracking and installing the exact gem and version required. A security vulnerability exists in Bundler versions 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16, which stems from the fact that dependency...

SUSE-SU-2021:1837-1 Security update for qemu

This update for qemu fixes the following issues: - Fix out-of-bounds access issue while doing multi block SDMA CVE-2020-25085, bsc1176681 - Fix out-of-bounds read information disclosure in icmp6sendechoreply CVE-2020-10756, bsc1172380 - QEMU BIOS fails to read stage2 loader on s390x bsc1186290 -...

Remote Code Execution (RCE)

Overview Affected versions of this package are vulnerable to Remote Code Execution RCE. This can occur when used with untrusted input, due to unsafe PAC file handling. In order to exploit this vulnerability in practice, this either requires an attacker on your local network, a specific vulnerable...

CVE-2021-27676

Centreon version 20.10.2 is affected by a cross-site scripting XSS vulnerability. The depdescription Dependency Description and depname Dependency Name parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration Notifications Hosts page...

[SECURITY] Fedora 33 Update: composer-2.0.13-1.fc33

Composer helps you declare, manage and install dependencies of PHP projects, ensuring you have the right stack everywhere. Documentation: https://getcomposer.org/doc/...

[SECURITY] Fedora 34 Update: composer-2.0.13-1.fc34

Composer helps you declare, manage and install dependencies of PHP projects, ensuring you have the right stack everywhere. Documentation: https://getcomposer.org/doc/...

Centreon 跨站脚本漏洞

Centreon Merethis Centreon is a set of open source system monitoring tools from the French company Centreon . The product mainly provides monitoring functions for resources such as network, system and application programs. A security vulnerability exists in Centreon version 20.10.2, which stems...

Security Bulletin: Information disclosure vulnerability in WebSphere Application Server Liberty

Summary This security bulletin addresses the Information Disclosure vulnerability that has been found to impact Websphere Liberty in IBM Tivoli Application Dependency Discovery Manager. Vulnerability Details CVEID: CVE-2020-5258 DESCRIPTION: Dojo dojo could allow a remote attacker to inject...

GHSA-FP4W-JXHP-M23P Dependency Confusion in Bundler

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.17 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that...

Dependency Confusion in Bundler

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.17 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that...

GHSA-RRFW-HG9M-J47H Signature Validation Bypass

Impact An authentication bypass exists in the goxmldsig this library uses to determine if SAML assertions are genuine. An attacker could craft a SAML response that would appear to be valid but would not have been genuinely issued by the IDP. Patches Version 0.4.2 bumps the dependency which should...

CVE-2021-32632

Pajbot is a Twitch chat bot. Pajbot versions prior to 1.52 are vulnerable to cross-site request forgery CSRF. Hosters of the bot should upgrade to v1.52 or stable to install the patch or, as a workaround, can add one modern dependency...

CVE-2021-32632

Pajbot is a Twitch chat bot. Pajbot versions prior to 1.52 are vulnerable to cross-site request forgery CSRF. Hosters of the bot should upgrade to v1.52 or stable to install the patch or, as a workaround, can add one modern dependency...

Cross site request forgery (csrf)

Pajbot is a Twitch chat bot. Pajbot versions prior to 1.52 are vulnerable to cross-site request forgery CSRF. Hosters of the bot should upgrade to v1.52 or stable to install the patch or, as a workaround, can add one modern dependency...

CVE-2021-32632

Pajbot is a Twitch chat bot. CVE-2021-32632 covers CSRF in Pajbot versions prior to 1.52, enabling modification of commands, modules, and banphrases via hidden iframes. Affected component: the web application lacks sufficient request validation, leading to cross-site forgery. Impact is defined as...

RHEL 8 : systemd (RHSA-2021:1611)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1611 advisory. The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides...

GHSA-4GH8-X3VV-PHHG Predictable SIF UUID Identifiers in github.com/sylabs/sif

Impact The siftool new command and func siftool.New produce predictable UUID identifiers due to insecure randomness in the version of the github.com/satori/go.uuid module used as a dependency. Patches A patch is available in version = v1.2.3 of the module. Users are encouraged to upgrade. The pat...

Design/Logic Flaw

Password generator feature in Kaspersky Password Manager was not completely cryptographically strong and potentially allowed an attacker to predict generated passwords in some cases. An attacker would need to know some additional information for example, time of password generation...

OPENSUSE-SU-2021:0719-1 Security update for java-11-openjdk

This update for java-11-openjdk fixes the following issues: - Update to upstream tag jdk-11.0.11+9 April 2021 CPU CVE-2021-2163: Fixed incomplete enforcement of JAR signing disabled algorithms bsc1185055 CVE-2021-2161: Fixed incorrect handling of partially quoted arguments in ProcessBuilder...

SUSE-SU-2021:1554-1 Security update for java-11-openjdk

This update for java-11-openjdk fixes the following issues: - Update to upstream tag jdk-11.0.11+9 April 2021 CPU CVE-2021-2163: Fixed incomplete enforcement of JAR signing disabled algorithms bsc1185055 CVE-2021-2161: Fixed incorrect handling of partially quoted arguments in ProcessBuilder...