UVI-2021-1000877 usb: dwc3: ep0: fix NULL pointer exception

usb: dwc3: ep0: fix NULL pointer exception This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.195 by commit...

UVI-2021-1000869 bonding: init notify_work earlier to avoid uninitialized use

bonding: init notifywork earlier to avoid uninitialized use This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.195 by commit...

UVI-2021-1000868 isdn: mISDN: netjet: Fix crash in nj_probe:

isdn: mISDN: netjet: Fix crash in njprobe: This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.195 by commit...

UVI-2021-1000859 tracing: Correct the length check which causes memory corruption

tracing: Correct the length check which causes memory corruption This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.237 by commit...

UVI-2021-1000854 net/qla3xxx: fix schedule while atomic in ql_sem_spinlock

net/qla3xxx: fix schedule while atomic in qlsemspinlock This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.237 by commit...

GSD-2021-1000853 wq: handle VM suspension in stall detection

wq: handle VM suspension in stall detection This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.237 by commit...

GSD-2021-1000851 isdn: mISDN: netjet: Fix crash in nj_probe:

isdn: mISDN: netjet: Fix crash in njprobe: This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.237 by commit...

UVI-2021-1000845 usb: dwc3: ep0: fix NULL pointer exception

usb: dwc3: ep0: fix NULL pointer exception This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.273 by commit...

GSD-2021-1000841 net/qla3xxx: fix schedule while atomic in ql_sem_spinlock

net/qla3xxx: fix schedule while atomic in qlsemspinlock This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.273 by commit...

UVI-2021-1000840 wq: handle VM suspension in stall detection

wq: handle VM suspension in stall detection This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.273 by commit...

UVI-2021-1000831 kvm: avoid speculation-based attacks from out-of-range memslot accesses

kvm: avoid speculation-based attacks from out-of-range memslot accesses This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.4.273 by commit...

GSD-2021-1000830 ftrace: Do not blindly read the ip address in ftrace_bug()

ftrace: Do not blindly read the ip address in ftracebug This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.4.273 by commit...

GSD-2021-1000828 bonding: init notify_work earlier to avoid uninitialized use

bonding: init notifywork earlier to avoid uninitialized use This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.4.273 by commit...

Google for OpSec data discovery

Following last months post about what OpSec is and how it can benefit your company I wanted go a step further, and look at some of the ways you can super charge your searches to find interesting data about your company. Basic search parameters As I mentioned last month, one of the most useful too...

CVE-2021-21004

In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache Tika

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Apache Tika. Vulnerability Details CVEID: CVE-2021-28657 DESCRIPTION: Apache Tika is vulnerable to a denial of service, caused by an infinite loop flaw in the MP3 parser. By persuading a victim to open a...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Node.js. Vulnerability Details CVEID: CVE-2021-23362 DESCRIPTION: Node.js hosted-git-info module is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in the fromUr...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache PDFBox

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Apache PDFBox. Vulnerability Details CVEID: CVE-2021-27807 DESCRIPTION: Apache PDFBox is vulnerable to a denial of service, caused by an infinite loop flaw. By persuading a victim to open a specially-crafted...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Python urllib3

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Python urllib3. Vulnerability Details CVEID: CVE-2021-28363 DESCRIPTION: urllib3 for python is vulnerable to a man-in-the-middle attack, caused by improper certificate validation in some cases involving HTTPS...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Netty

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Netty. Vulnerability Details CVEID: CVE-2021-21409 DESCRIPTION: Netty is vulnerable to request smuggling, caused by improper validation of request, caused by missing validation of content-length. By sending...