CVE-2021-45067

Acrobat Reader DC version 21.007.20099 and earlier, 20.004.30017 and earlier and 17.011.30204 and earlier are affected by an Access of Memory Location After End of Buffer vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass...

CVE-2021-43974

An issue was discovered in SysAid ITIL 20.4.74 b10. The /enduserreg endpoint is used to register end users anonymously, but does not respect the server-side setting that determines if anonymous users are allowed to register new accounts. Configuring the server-side setting to disable anonymous us...

CVE-2021-43974

An issue was discovered in SysAid ITIL 20.4.74 b10. The /enduserreg endpoint is used to register end users anonymously, but does not respect the server-side setting that determines if anonymous users are allowed to register new accounts. Configuring the server-side setting to disable anonymous us...

January 11, 2022—KB5009595 (Security-only update)

None None...

Microsoft Windows DirectX 安全漏洞

Microsoft Windows DirectX is the DirectX End-User Runtime Web Installer from Microsoft Corporation USA. A security vulnerability exists in Microsoft Windows DirectX. The following products and editions are affected:Windows 10 Version 1809 for ARM64-based Systems,Windows Server 2019,Windows Server...

PT-2022-7038

Name of the Vulnerable Software and Affected Versions Log4j versions 1.2.x Description The issue is related to the JDBCAppender in Log4j, which accepts an SQL statement as a configuration parameter. This allows attackers to manipulate the SQL by entering crafted strings into input fields or heade...

Regular Expression Denial of Service (ReDoS) in lodash

All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service ReDoS via the toNumber, trim and trimEnd functions. Steps to reproduce provided by reporter Liyuan Chen: var lo = require'lodash'; function buildblankn var ret = "1" for var i = 0; i n; i++ ret ...

PT-2025-8568

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A subtraction overflow bug has been resolved in the Linux kernel. The issue occurs when hole end is small enough to cause a subtraction overflow, or when addr + 2 min alignment overflows...

openSUSE 15 Security Update : log4j12 (openSUSE-SU-2021:1612-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1612-1 advisory. - JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The...

Apache Log4j 1.2.x <= 1.2.17 RCE Vulnerability - Linux

Apache Log4j is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:log4j"...

Apache Log4j 1.2.x <= 1.2.17 RCE Vulnerability - Windows

Apache Log4j is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:log4j"...

sssd bug fix and enhancement update

The System Security Services Daemon SSSD service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch NSS and the Pluggable Authentication Modules PAM interfaces toward the system, and a pluggable back-end system ...

ALBA-2021:5228 sssd bug fix and enhancement update

The System Security Services Daemon SSSD service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch NSS and the Pluggable Authentication Modules PAM interfaces toward the system, and a pluggable back-end system ...

sssd bug fix and enhancement update

An update is available for sssd. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The System Security Services Daemon SSSD service provides a set of daemons to...

Apache Log4j 1.2.x RCE Vulnerability (Windows, Dec 2021) - Version Check

Apache Log4j is prone to a remote code execution RCE vulnerability in JMSAppender. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Apache Log4j End of Life (EOL) Detection - Windows

The Apache Log4j version on the remote host has reached the End of Life EOL and should not be used anymore. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CLSA-2021-1639681859 Fix CVE(s): CVE-2021-3927, CVE-2021-3928

SECURITY UPDATE: Fix heap-based buffer overflow when reading character past end of line - debian/patches/CVE-2021-3927.patch: Correct the cursor column in src/exdocmd.c. - CVE-2021-3927 SECURITY UPDATE: Fix stack-based buffer overflow when reading uninitialized memory when giving spell suggestion...

Apache Log4j 1.2.x RCE Vulnerability (Linux/Unix, Dec 2021) - Version Check

Apache Log4j is prone to a remote code execution RCE vulnerability in JMSAppender. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Build successful data security evaluation criteria with help from your peers

When you evaluate data security products it is imperative to have the end goal in sight. If you look forward 365 days from now, what is the best way to predict how your team will use the product so that you can communicate the value that it will provide? One approach is to examine operational...

Security Bulletin: IBM QRadar SIEM Application Framework v1 (CentOS6) is End of Life

Summary IBM QRadar SIEM's App Framework V1, based on CentOS 6, contains known vulnerabilities and is based on technologies that are no longer being supported. Vulnerability Details CVEID: CVE-2019-9636 DESCRIPTION: Python urllib.parse.urlsplit and urllib.parse.urlparse components could allow a...