CVE-2021-20302

A flaw was found in OpenEXR's TiledInputFile functionality. This flaw allows an attacker who can submit a crafted single-part non-image to be processed by OpenEXR, to trigger a floating-point exception error. The highest threat from this vulnerability is to system availability...

SolarWinds Serv-U FTP and Managed File Transfer CVE-2021-35211: What You Need to Know

On July 12, 2021, SolarWinds confirmed an actively exploited zero-day vulnerability, CVE-2021-35211, in the Serv-U FTP and Managed File Transfer component of SolarWinds15.2.3 HF1 released May 5, 2021 and all prior versions. Successful exploitation of CVE-2021-35211 could enable an attacker to gai...

CVE-2021-32734

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, the Nextcloud Text application shipped with Nextcloud Server returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. The issu...

CVE-2021-32734 File path disclosure of shared files in Nextcloud Text application

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, the Nextcloud Text application shipped with Nextcloud Server returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. The issu...

File path disclosure of shared files in Nextcloud Text application

None...

Cross-site scripting (XSS) from field and configuration text displayed in the Panel

On Saturday, @hdodov reported that the Panel's ListItem component used in the pages and files section for example displayed HTML in page titles as it is. This could be used for cross-site scripting XSS attacks. We used his report as an opportunity to find and fix XSS issues related to dynamic sit...

Advisory ROSA-SA-2021-1987

Software: tigervnc 1.8.0 OS: Cobalt 7.9 CVE-ID: CVE-2020-26117 CVE-Crit: HIGH CVE-DESC: In the files rfb / CSecurityTLS.cxx and rfb / CSecurityTLS.java in TigerVNC before 1.11.0, the viewers do not handle TLS certificate exceptions correctly. They store certificates as authoritative sources, whic...

Advisory ROSA-SA-2021-1842

Software: giflib 4.1.6 OS: Cobalt 7.9 CVE-ID: CVE-2015-7555 CVE-Crit: MEDIUM CVE-DESC: Heap-based buffer overflow in giffix.c in giffix in giflib 5.1.1 allows attackers to cause a denial of service program crash via the created image and logical screen width fields in a GIF file. CVE-STATUS:...

Advisory ROSA-SA-2021-1821

Software: dcraw 9.19 OS: Cobalt 7.9 CVE-ID: CVE-2018-19565 CVE-Crit: HIGH CVE-DESC: Buffer re-reading in cropmaskedpixels in dcraw before 9.28 could have been used by attackers who could provide malicious files to crash the application that binds the dcraw code or leak private information...

The vulnerability of the AutoBuild service on the AVEVA System Platform allows a intruder to trigger a service failure.

The vulnerability of the AutoBuild service on the AVEVA System Platform is related to an unprocessed exception. Exploiting this vulnerability could allow a malicious actor to trigger a service failure remotely...

GSD-2021-1001033 usb: dwc3: ep0: fix NULL pointer exception

usb: dwc3: ep0: fix NULL pointer exception This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.12.11 by commit...

UVI-2021-1001033 usb: dwc3: ep0: fix NULL pointer exception

usb: dwc3: ep0: fix NULL pointer exception This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.12.11 by commit...

UVI-2021-1000955 usb: dwc3: ep0: fix NULL pointer exception

usb: dwc3: ep0: fix NULL pointer exception This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.44 by commit...

GSD-2021-1000955 usb: dwc3: ep0: fix NULL pointer exception

usb: dwc3: ep0: fix NULL pointer exception This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.44 by commit...

UVI-2021-1000898 usb: dwc3: ep0: fix NULL pointer exception

usb: dwc3: ep0: fix NULL pointer exception This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.126 by commit...

GSD-2021-1000898 usb: dwc3: ep0: fix NULL pointer exception

usb: dwc3: ep0: fix NULL pointer exception This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.126 by commit...

UVI-2021-1000877 usb: dwc3: ep0: fix NULL pointer exception

usb: dwc3: ep0: fix NULL pointer exception This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.195 by commit...

GSD-2021-1000877 usb: dwc3: ep0: fix NULL pointer exception

usb: dwc3: ep0: fix NULL pointer exception This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.195 by commit...

GSD-2021-1000860 usb: dwc3: ep0: fix NULL pointer exception

usb: dwc3: ep0: fix NULL pointer exception This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.237 by commit...

UVI-2021-1000845 usb: dwc3: ep0: fix NULL pointer exception

usb: dwc3: ep0: fix NULL pointer exception This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.273 by commit...