PT-2021-23059

Name of the Vulnerable Software and Affected Versions @theia/plugin-ext component of Eclipse Theia versions prior to 1.18.0 Description The issue allows Webview contents to be hijacked via the postMessage function. Recommendations For versions prior to 1.18.0, update to version 1.18.0 or later to...

CVE-2021-41038: Improper Verification of Source of a Communication Channel

In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage...

PT-2021-30365

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.14.14 Description The issue is related to the connector bad edid function in the Linux Kernel, where the num of ext is capped by num blocks read. This could potentially lead to a security vulnerability, althou...

NewStart CGSL CORE 5.05 / MAIN 5.05 : grub2 Multiple Vulnerabilities (NS-SA-2021-0139)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has grub2 packages installed that are affected by multiple vulnerabilities: - A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw...

PT-2021-30103

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.71 Description The issue concerns the ext4 file system in the Linux Kernel. It involves adding error checking to the ext4 ext replay set iblocks function. The actual impact and potential for attack have not...

PT-2021-30175

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.10 through v5.14.9 Description The issue concerns the ext4 file system in the Linux Kernel. It involves adding error checking to the ext4 ext replay set iblocks function. The actual impact and attack plausibility have...

PT-2021-26180

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.10 through v5.14.9 Description: The issue concerns the ext4 file system in the Linux Kernel. It involves adding error checking to the ext4 ext replay set iblocks function. The actual impact and attack plausibility hav...

PT-2021-26108

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.71 Description The issue concerns the ext4 file system in the Linux Kernel. It involves adding error checking to the ext4 ext replay set iblocks function. The actual impact and potential for attack have not...

The vulnerability of the ext_get_plugin() function in the syntax analyzer and data modeling tool of YANG Libyang, related to an unvalidated return value, allows a malicious actor to trigger a service failure.

The vulnerability of the extgetplugin function in the syntax analyzer and data modeling tool of the YANG Libyang language is related to the lack of checking for a NULL revision. Exploiting this vulnerability could allow an attacker to cause service failures...

The vulnerability of the read_yin_container() function in the syntax analyzer and data modeling tool of the YANG Libyang language lies in its unvalidated return value. This allows attackers to trigger a service failure.

The vulnerability of the readyincontainer function in the syntax analyzer and data modeling tool of the YANG Libyang language is related to the lack of checking for NULL values in retval-extr. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Cross-site Scripting (XSS)

@theia/plugin-ext is vulnerable to cross-site scripting. An attacker is able to exploit the vulnerability by injecting malicious script into the system via the hostMessaging function. The vulnerability exists due to the lack of origin or parent check...

AZL-6595 CVE-2021-40490 affecting package kernel for versions less than 5.10.78.1-1

A race condition was discovered in ext4writeinlinedataend in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel through 5.13.13...

Authorization Bypass

servicemesh-proxy is vulnerable to authorization bypass. It allows specifically crafted requests to bypass authorization. Attackers may be able to escalate privileges when using ext-authz extension or back end service that uses multiple value headers for authorization. A specifically constructed...

CVE-2021-32777

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the HTTP spec. However,...

CVE-2021-32777

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the HTTP spec. However,...

Authorization

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the HTTP spec. However,...

CVE-2021-32777

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the HTTP spec. However,...

CVE-2021-32777

CVE-2021-32777 affects Envoy’s ext-authz extension, where sending request headers to the external authorization service fails to merge multiple value headers as required by HTTP spec. This can allow specially crafted requests to bypass authorization or escalate privileges when multiple-valued hea...

CVE-2021-32777

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the HTTP spec. However,...

CVE-2021-32777: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the HTTP spec. However,...