PT-2021-20957 · Hitachi Energy · Pwc600 +5

Name of the Vulnerable Software and Affected Versions: Hitachi Energy Relion 670 Series versions 2.0 through 2.2.3.4 Hitachi Energy Relion 670 Series version 2.2.4 Hitachi Energy Relion 670/650 Series versions 2.1 through 2.2.0 Hitachi Energy Relion 670/650 Series version 2.2.4 Hitachi Energy...

PT-2021-20145 · Gocr +1 · Gocr +1

Name of the Vulnerable Software and Affected Versions: gocr versions 0.53 through 0.53-20200802 Description: A stack-based buffer overflow issue was found in the try to divide boxes function in pgm2asc.c. This issue can potentially be exploited. Recommendations: For gocr versions 0.53 through...

PT-2021-20143 · Gocr +1 · Gocr +1

Name of the Vulnerable Software and Affected Versions: gocr versions 0.53-20200802 Description: A stack-based buffer overflow issue was found in the measure pitch function in pgm2asc.c. This issue can potentially be exploited. Recommendations: For gocr versions 0.53-20200802, as a temporary...

PT-2021-6408 · Microsoft · Windows +1

Name of the Vulnerable Software and Affected Versions: Microsoft App Installer versions prior to 1.21.3421.0 Description: The issue is related to a spoofing vulnerability in the AppX installer that affects Microsoft Windows. This vulnerability can be exploited by attackers using specially crafted...

PT-2021-5360 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: Moodle versions 3.11 to 3.11.3 Moodle versions 3.10 to 3.10.7 Moodle versions 3.9 to 3.9.10 Moodle versions prior to 3.9 Description: A flaw was found in the "delete related badge" functionality of Moodle, which did not include the necessary...

kernel security, bug fix, and enhancement update

4.18.0-348.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x...

CVE-2021-41266

Minio console is a graphical user interface for the for MinIO operator. Minio itself is a multi-cloud object storage project. Affected versions are subject to an authentication bypass issue in the Operator Console when an external IDP is enabled. All users on release v0.12.2 and before are affect...

USN-5141-1: Firejail vulnerability

Roman Fiedler discovered that a race condition existed in Firejail when using OverlayFS to prevent writes to the underlying file system. A local attacker could use this to gain administrative privileges. Note: this update disables support for OverlayFS in Firejail...

PT-2021-8284 · Unknown · Diffie-Hellman Key Agreement Protocol

Name of the Vulnerable Software and Affected Versions: Diffie-Hellman Key Agreement Protocol affected versions not specified Description: The Diffie-Hellman Key Agreement Protocol allows remote attackers to send arbitrary numbers that are not public keys, triggering expensive server-side DHE...

Security fix for the ALT Linux 10 package thunderbird version 91.3.0-alt1

91.3.0-alt1 built Nov. 10, 2021 Andrey Cherepanov in task 288818 Nov. 3, 2021 Andrey Cherepanov - New version. - Security fixes: + CVE-2021-38503 iframe sandbox rules did not apply to XSLT stylesheets + CVE-2021-38504 Use-after-free in file picker dialog + CVE-2021-38505 Windows 10 Cloud Clipboar...

PT-2021-20331 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: Dolibarr version 13.0.2 Description: The website builder module in Dolibarr allows remote PHP code execution due to an incomplete protection mechanism. Specifically, while system, exec, and shell exec are blocked, backticks are not blocked,...

GHSA-26CM-QRC6-MFGJ Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker

Impact LDAP injection vulnerability, only affects instances with LDAP authentication enabled. Patches Patch for vulnerability released with v1.16.3. Workarounds Disable LDAP feature if in use References OWASP LDAP Injection Prevention Cheat Sheet For more information If you have any questions or...

Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker

Impact LDAP injection vulnerability, only affects instances with LDAP authentication enabled. Patches Patch for vulnerability released with v1.16.3. Workarounds Disable LDAP feature if in use References OWASP LDAP Injection Prevention Cheat Sheet For more information If you have any questions or...

CVE-2021-25979 Apostrophe - Insufficient Session Expiration

Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigation for older releases the user account...

CVE-2021-37850

ESET was made aware of a vulnerability in its consumer and business products for macOS that enables a user logged on to the system to stop the ESET daemon, effectively disabling the protection of the ESET security product until a system reboot...

CVE-2021-37850

ESET was made aware of a vulnerability in its consumer and business products for macOS that enables a user logged on to the system to stop the ESET daemon, effectively disabling the protection of the ESET security product until a system reboot...

Privilege escalation

ESET was made aware of a vulnerability in its consumer and business products for macOS that enables a user logged on to the system to stop the ESET daemon, effectively disabling the protection of the ESET security product until a system reboot...

PT-2021-23196 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.7.0 TensorFlow versions 2.6.1 and earlier TensorFlow versions 2.5.2 and earlier TensorFlow versions 2.4.4 and earlier Description: The implementation of FusedBatchNorm kernels in TensorFlow is vulnerable to a he...

PT-2021-22580 · Unknown · Phpgurukul Hospital Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Hospital Management System version 4.0 Description: Multiple Cross Site Scripting XSS vulnerabilities exist in the system. The issue is related to the searchdata parameter in "/doctor/search.php" and "/admin/patient-search.php" API...

PT-2021-23185 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.7.0 TensorFlow versions 2.6.1 and earlier TensorFlow versions 2.5.2 and earlier TensorFlow versions 2.4.4 and earlier Description: The shape inference code for tf.ragged.cross can trigger a read outside of bound...