Unbreakable Enterprise kernel security update

5.4.17-2102.202.5 - sctp: delay autoasconf init until binding the first addr Xin Long Orabug: 32907967 CVE-2021-23133 CVE-2021-23133 - dm ioctl: fix out of bounds array access when no devices Mikulas Patocka Orabug: 32860491 CVE-2021-31916 - uek-rpm: update kABI lists for the new symbols Saeed...

PT-2021-15889 · Betterlinks · Simple 301 Redirects

Name of the Vulnerable Software and Affected Versions: Simple 301 Redirects by BetterLinks WordPress plugin versions prior to 2.0.4 Description: The issue concerns the import data function, which lacks capability and nonce checks. This allows unauthenticated users to import site redirects...

PT-2021-15885 · WordPress · This Gallery From Files

Name of the Vulnerable Software and Affected Versions: This Gallery from files WordPress plugin versions 1.6.0 and earlier Description: The issue arises from the improper sanitization of filenames before being output in an error message when they have an invalid extension, leading to a reflected...

PT-2022-11374

Name of the Vulnerable Software and Affected Versions cryptsetup versions 2.2.0 through 2.3.6 cryptsetup versions 2.4.0 through 2.4.2 Description A flaw was found in cryptsetup that could allow an attacker with physical access to a medium, such as a flash disk, to trick the system into disabling...

Design/Logic Flaw

Restund is an open source NAT traversal server. The restund TURN server can be instructed to open a relay to the loopback address range. This allows you to reach any other service running on localhost which you might consider private. In the configuration that we ship...

PT-2021-15203

Name of the Vulnerable Software and Affected Versions PowerLogic EGX100 versions 3.0.0 and newer PowerLogic EGX300 all versions Description A CWE-20: Improper Input Validation issue exists that could cause denial of service or remote code execution via a specially crafted HTTP packet...

PT-2021-7758 · Libxml2 +2 · Libxml2 +2

Name of the Vulnerable Software and Affected Versions: ImageMagick versions prior to 7.0.10-31 Description: The issue is related to a NULL pointer dereference flaw in the ReadSVGImage function of the coders/svg.c component. This flaw is caused by not checking the return value from libxml2's...

Security Bulletin: IBM DataPower Gateway appliances are affected by a vulnerability in IPMI (CVE-2018-1668)

Summary IBM DataPower Gateway Appliances has addressed the following vulnerability: CVE-2018-1668 Vulnerability Details CVEID: CVE-2018-1668 DESCRIPTION: IBM WebSphere DataPower Appliances allows "null" logins which could give read access to IPMI data to obtain sensitive information. CVSS Base...

PT-2021-7762 · Rockwell Automation · Isagraf Runtime

Name of the Vulnerable Software and Affected Versions: Rockwell Automation ISaGRAF Runtime versions 4.x through 5.x Description: The issue concerns the encryption of passwords used to execute privileged commands in the ISaGRAF Runtime. Specifically, a fixed key value is used with the tiny...

PT-2021-3461

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions affected versions not specified Description This issue concerns a remote code execution flaw in the Windows Print Spooler service, also known as PrintNightmare. The vulnerability allows remote attackers to execute...

GSD-2021-1000548 i2c: i801: Don't generate an interrupt on bus reset

i2c: i801: Don't generate an interrupt on bus reset This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.12.9 by commit...

PT-2021-4286

Name of the Vulnerable Software and Affected Versions SOGo versions 2.0.5a through 2.4.1 SOGo versions 3.x through 5.x before 5.1.1 Description The issue is related to the incorrect validation of cryptographic signatures in SAML assertions, which could allow a remote attacker to impersonate users...

Authentication Bypass

github.com/kiali/kiali is vulnerable to authentication bypass. When RBAC is disabled, the token validation in the authentication strategy OpenID does not occur and allows an attacker to bypass authentication...

PT-2021-19379 · Opentext · Opentext Brava! Desktop

Name of the Vulnerable Software and Affected Versions: OpenText Brava! Desktop version 16.6.3.84 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file...

PT-2021-19372 · Opentext · Opentext Brava! Desktop

Name of the Vulnerable Software and Affected Versions: OpenText Brava! Desktop version 16.6.3.84 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file...

PT-2021-19359 · Opentext · Opentext Brava! Desktop

Name of the Vulnerable Software and Affected Versions: OpenText Brava! Desktop version 16.6.3.84 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file...

UVI-2021-1000190 KVM: VMX: Disable preemption when probing user return MSRs

KVM: VMX: Disable preemption when probing user return MSRs This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.12.5 by commit...

CVE-2021-32646

Roomer is a discord bot cog extension which provides automatic voice channel generation as well as private voice and text channels. A vulnerability has been discovered allowing discord users to get the manage channel permissions in a private VC they have joined. This allowed them to make changes ...

PT-2021-8015 · Zeromq +2 · Zeromq +2

Name of the Vulnerable Software and Affected Versions: ZeroMQ versions prior to 4.3.3 Description: A flaw in the ZeroMQ server allows a malicious client to cause a stack buffer overflow on the server by sending crafted topic subscription requests and then unsubscribing. This poses a threat to...

PT-2021-16927 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.0.0 through 3.9.26 Description: A missing token check causes a CSRF issue in data download endpoints in com banners and com sysinfo. This allows for potential exploitation. Recommendations: For Joomla! versions 3.0.0 throug...