CLSA-2021-1636389447 Fixed CVEs in glibc: CVE-2021-43396, CVE-2021-3326

CVE-2021-3326: avoid denial of service due to a failed assertion - CVE-2021-43396: check actual stored character in state reset code...

CVE-2021-33209

An issue was discovered in Fimer Aurora Vision before 2.97.10. The response to a failed login attempt discloses whether the username or password is wrong, helping an attacker to enumerate usernames. This can make a brute-force attack easier...

PT-2021-20078

Name of the Vulnerable Software and Affected Versions Fimer Aurora Vision versions prior to 2.97.10 Description An issue was discovered where the response to a failed login attempt discloses whether the username or password is wrong, helping an attacker to enumerate usernames. This can make a...

Improper Validation Of create2 Return Value

Handle leastwood Vulnerability details Impact The BeaconProxyDeployer.deploy function is used to deploy lightweight proxy contracts that act as each asset's vault. The function does not revert properly if there is a failed contract deployment or revert from the create2 opcode as it does not...

CVE-2021-39220 Bypass of image blocking in Nextcloud Mail

Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render images in emails to not leak the read state or user IP. The privacy filter failed to filter images with a relative protocol. It is recommend...

Markets Do Not Operate Correctly on Non-Standard Tokens

Handle leastwood Vulnerability details Impact There are a number of functions which interact with uToken in Swivel.sol but do not check the return value of the associated transfer, approve or transferFrom call. As a result, if a market is created using a non-standard token, a failed call will be...

DDOS by cancelling orders or removing approvals

Handle cmichel Vulnerability details The market assumes that the maker of an order approved the swivel contract as there are many calls that move funds from the maker to the contract, see Swivel.initiateVaultFillingZcTokenInitiate/initiateZcTokenFillingVaultInitiate: uToken.transferFromo.maker,...

API Key Authentication Failed

This plugin is raised when the scanner has not been able to authenticate against the web application using the API key credentials provided in the scan policy. Check the output of the plugin to get an explanation of the issue encountered by the scan. No source data...

Bearer Token Authentication Failed

This plugin is raised when the scanner has not been able to authenticate against the web application using the bearer authentication credentials provided in the scan policy. Check the output of the plugin to get an explanation of the issue encountered by the scan. No source data...

ManageEngine ADAudit Plus Authenticated File Write RCE

This module exploits security issues in ManageEngine ADAudit Plus prior to 7006 that allow authenticated users to execute arbitrary code by creating a custom alert profile and leveraging its custom alert script component. The module first runs a few checks to test the provided credentials, retrie...

EulerOS 2.0 SP2 : bind (EulerOS-SA-2021-2354)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses...

ALSA-2021:3447 Important: kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: powerpc: KVM guest OS users can cause host OS memory corruption CVE-2021-37576 kernel: slab-out-of-bounds access in xdrsetpagebase in net/sunrpc/xdr.c CVE-2021-38201 For more details abou...

CVE-2021-36691

libjxl v0.5.0 is affected by a Assertion failed issue in lib/jxl/image.cc jxl::PlaneBase::PlaneBase. When encoding a malicous GIF file using cjxl, an attacker can trigger a denial of service...

CVE-2021-36691

libjxl v0.5.0 is affected by a Assertion failed issue in lib/jxl/image.cc jxl::PlaneBase::PlaneBase. When encoding a malicous GIF file using cjxl, an attacker can trigger a denial of service...

CVE-2021-36691

libjxl v0.5.0 is affected by a Assertion failed issue in lib/jxl/image.cc jxl::PlaneBase::PlaneBase. When encoding a malicous GIF file using cjxl, an attacker can trigger a denial of service...

CVE-2021-36691

libjxl v0.5.0 is affected by a Assertion failed issue in lib/jxl/image.cc jxl::PlaneBase::PlaneBase. When encoding a malicous GIF file using cjxl, an attacker can trigger a denial of service...

CVE-2021-36691

CVE-2021-36691 affects libjxl v0.5.0. The issue is an assertion failure in lib/jxl/image.cc jxl::PlaneBase::PlaneBase(), which can be triggered when encoding a malicious GIF file with cjxl, leading to a denial of service. The available connected documents describe the same vulnerability pattern a...

CVE-2021-36691: Reachable Assertion

libjxl v0.5.0 is affected by a Assertion failed issue in lib/jxl/image.cc jxl::PlaneBase::PlaneBase. When encoding a malicous GIF file using cjxl, an attacker can trigger a denial of service...

Denial Of Service

bind is vulnerable to denial of service. The vulnerability exists due the system terminated due to a failed assertion check...

CVE-2021-25218

In BIND 9.16.19, 9.17.16. Also, version 9.16.19-S1 of BIND Supported Preview Edition When a vulnerable version of named receives a query under the circumstances described above, the named process will terminate due to a failed assertion check. The vulnerability affects only BIND 9 releases 9.16.1...