CVE-2021-38496

During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird 78.15, Thunderbird 91.2, Firefox ESR 91.2, Firefox ESR 78.15, and Firefox 93...

Security Vulnerabilities fixed in Thunderbird 78.15

During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentially exploitable crash. Mozilla developers and community members Andreas Pehrson and Christian Holler reported memory safety bugs present in Thunderbird 78.14...

Mozilla Firefox < 93.0

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 93.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-43 advisory. - A use-after-free could have occurred when an HTTP2 session object was released on a different thread, leading...

Mozilla Firefox ESR < 78.15

The version of Firefox ESR installed on the remote Windows host is prior to 78.15. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-44 advisory. - Mozilla developers and community members Andreas Pehrson and Christian Holler reported memory safety bugs present ...

Mozilla Firefox ESR < 91.2

The version of Firefox ESR installed on the remote Windows host is prior to 91.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-45 advisory. - Mozilla developers and community members Kevin Brosnan, Mihai Alexandru Michis, and Christian Holler reported memor...

Security Vulnerabilities fixed in Firefox ESR 78.15 — Mozilla

During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentially exploitable crash. Mozilla developers and community members Andreas Pehrson and Christian Holler reported memory safety bugs present in Firefox 92 and...

Mozilla Firefox < 93.0

The version of Firefox installed on the remote Windows host is prior to 93.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-43 advisory. - A use-after-free could have occurred when an HTTP2 session object was released on a different thread, leading to memory...

SUSE SLES11: MozillaFirefox / MozillaFirefox-translations-common / etc (SUSE-SU-2021:14821-1)

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14821-1 advisory. This update contains the Firefox Extended Support Release 91.1.0 ESR. Fixed: Various stability, functionality, and security fixes MFSA 2021-40...

HybridPool's reserve is converted to "amount" twice

Handle cmichel Vulnerability details The HybridPool's reserves are stored as Bento "amounts" not Bento shares in updateReserves because balance converts the current share balance to amount balances. However, when retrieving the reserve0/1 storage fields in getReserves, they are converted to amoun...

CVE-2021-2464

Vulnerability in Oracle Linux component: OSwatcher. Supported versions that are affected are 7 and 8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Linux executes to compromise Oracle Linux. Successful attacks of this vulnerability c...

Cisco IOS XE SD-WAN Software Command Injection Vulnerability

Cisco IOS XE SD-WAN Software is a Cisco IOS XE network operating system used for network management software-defined networking. The vulnerability can be exploited to execute arbitrary commands with elevated privileges by including malicious input in the parameters of the affected command...

Vulnerability Spotlight: Information disclosure vulnerability in D-LINK DIR-3040 mesh router

Dave McDaniel of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw. Cisco Talos recently discovered an exploitable information disclosure vulnerability in the D-LINK DIR-3040 smart WiFi mesh router that could allow an adversary to eventually turn off the device or remove other... Thi...

Ubuntu: Security Advisory (USN-5087-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED12: MozillaFirefox / MozillaFirefox-branding-SLE / MozillaFirefox-devel / etc (SUSE-SU-2021:3191-1)

The remote SUSE Linux SLED12 / SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3191-1 advisory. This update contains the Firefox Extended Support Release 91.1.0 ESR. Fixed: Various stability, functionality, and securit...

Amazon Linux 2 : thunderbird (ALAS-2021-1709)

The version of thunderbird installed on the remote host is prior to 78.13.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1709 advisory. If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses...

CVE-2021-21798

An exploitable return of stack variable address vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause a stack variable to go out of scope, resulting in the application dereferencing a stale pointer. This can lead to code execution under the...

Important: thunderbird

Issue Overview: If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion of the STARTTLS handshake, then Thunderbird didn't ignore the injected data. This could have resulted in Thunderbird showing incorrect...

Siemens SINEMA Server

1. EXECUTIVE SUMMARY CVSS v3 4.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: SINEMA Server Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to obtain encoded...

Siemens Teamcenter Active Workspace

1. EXECUTIVE SUMMARY CVSS v3 4.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: Teamcenter Active Workspace Vulnerability: Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could lead to access control violations. 3. TECHNICAL...

Siemens Desigo CC Family

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: Desigo CC Family Vulnerability: Deserialization of Untrusted Data 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform remote code...