CVE-2021-43823

Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.33.2 is vulnerable to a side-channel attack where strings in private source code could be guessed by an authenticated but unauthorized actor. This issue affects the Saved Searches and Code Monitoring features. A...

PT-2021-6887 · Wireshark +3 · Wireshark +3

Name of the Vulnerable Software and Affected Versions: Wireshark versions 3.4.0 through 3.4.10 Wireshark version 3.6.0 Description: The issue is related to a crash in the Sysdig Event dissector, which can be exploited to cause a denial of service via packet injection or crafted capture file. This...

CVE-2021-35978

An issue was discovered in Digi TransPort DR64, SR44 VC74, and WR. The ZING protocol allows arbitrary remote command execution with SUPER privileges. This allows an attacker with knowledge of the protocol to execute arbitrary code on the controller including overwriting firmware, adding/removing...

Digi TransPort DR64 命令注入漏洞

The Digi International Digi TransPort is a full-featured cellular router from Digi International USA. A security vulnerability exists in the Digi TransPort DR64 that allows arbitrary remote commands to be executed using the SUPER privilege. This allows an attacker to exploit the vulnerability kno...

PT-2021-5597

Name of the Vulnerable Software and Affected Versions Log4j version 1.2 Description The issue is related to the JMSAppender in Log4j 1.2, which is vulnerable to deserialization of untrusted data. An attacker with write access to the Log4j configuration can provide TopicBindingName and...

PT-2021-23207 · Openolat · Openolat

Name of the Vulnerable Software and Affected Versions: OpenOlat versions prior to 15.5.12 and 16.0.5 Description: A path traversal issue exists in OpenOlat, allowing an attacker to create directory structures and write files anywhere on the target system by providing a filename with a relative pa...

GHSA-QRMM-W75W-3WPX Server side request forgery in SwaggerUI

SwaggerUI supports displaying remote OpenAPI definitions through the ?url parameter. This enables robust demonstration capabilities on sites like petstore.swagger.io, editor.swagger.io, and similar sites, where users often want to see what their OpenAPI definitions would look like rendered...

PT-2021-7905 · Aom +4 · Aom +4

Name of the Vulnerable Software and Affected Versions: AOM version 2.0.1 Description: The issue is related to a stack buffer overflow in the stats/rate hist.c component of the AOM library, which can be exploited by a remote attacker to execute arbitrary code. This can potentially allow for...

PT-2021-7903 · Aom +3 · Aom +3

Name of the Vulnerable Software and Affected Versions: AOM version 2.0.1 Description: The issue is related to a global buffer overflow in the av1/encoder/partition search.h component of the AOM library, which implements the AV1 codec. This overflow can be exploited by a remote attacker to execute...

Shopify: Ability to Disable the Login Attempt of any Shopify Owner for 24 hrs (Zero_Click)

Hello Team, I Found a Bug in which Hacker Have Ability to Disable the Login Attempt of any Shopify Owner With ZeroClick Summary: ---------- Proof of Concept; ------------------- Credentials: ------------- Victim = ███████.com ████████ Hacker = █████████.com Victim Sceanrio: ----------------- Step...

APM Java Agent Security Update

APM Java Agent Local Privilege Escalation issue ESA-2021-29 A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an application running with the APM Java agent. Using this vector, a malicious or compromised user account...

PT-2021-20957 · Hitachi Energy · Pwc600 +5

Name of the Vulnerable Software and Affected Versions: Hitachi Energy Relion 670 Series versions 2.0 through 2.2.3.4 Hitachi Energy Relion 670 Series version 2.2.4 Hitachi Energy Relion 670/650 Series versions 2.1 through 2.2.0 Hitachi Energy Relion 670/650 Series version 2.2.4 Hitachi Energy...

PT-2021-20145 · Gocr +1 · Gocr +1

Name of the Vulnerable Software and Affected Versions: gocr versions 0.53 through 0.53-20200802 Description: A stack-based buffer overflow issue was found in the try to divide boxes function in pgm2asc.c. This issue can potentially be exploited. Recommendations: For gocr versions 0.53 through...

PT-2021-20143 · Gocr +1 · Gocr +1

Name of the Vulnerable Software and Affected Versions: gocr versions 0.53-20200802 Description: A stack-based buffer overflow issue was found in the measure pitch function in pgm2asc.c. This issue can potentially be exploited. Recommendations: For gocr versions 0.53-20200802, as a temporary...

PT-2021-6408 · Microsoft · Windows +1

Name of the Vulnerable Software and Affected Versions: Microsoft App Installer versions prior to 1.21.3421.0 Description: The issue is related to a spoofing vulnerability in the AppX installer that affects Microsoft Windows. This vulnerability can be exploited by attackers using specially crafted...

PT-2021-5360 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: Moodle versions 3.11 to 3.11.3 Moodle versions 3.10 to 3.10.7 Moodle versions 3.9 to 3.9.10 Moodle versions prior to 3.9 Description: A flaw was found in the "delete related badge" functionality of Moodle, which did not include the necessary...

kernel security, bug fix, and enhancement update

4.18.0-348.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x...

CVE-2021-41266

Minio console is a graphical user interface for the for MinIO operator. Minio itself is a multi-cloud object storage project. Affected versions are subject to an authentication bypass issue in the Operator Console when an external IDP is enabled. All users on release v0.12.2 and before are affect...

USN-5141-1: Firejail vulnerability

Roman Fiedler discovered that a race condition existed in Firejail when using OverlayFS to prevent writes to the underlying file system. A local attacker could use this to gain administrative privileges. Note: this update disables support for OverlayFS in Firejail...

PT-2021-8284 · Unknown · Diffie-Hellman Key Agreement Protocol

Name of the Vulnerable Software and Affected Versions: Diffie-Hellman Key Agreement Protocol affected versions not specified Description: The Diffie-Hellman Key Agreement Protocol allows remote attackers to send arbitrary numbers that are not public keys, triggering expensive server-side DHE...